PT-2019-11787 · Jenkins · Jenkins Script Security Plugin+1

Nils Emmerich · CVE-2019-10393 · Publicado 2019-09-12 · Atualizado 2023-10-25

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1.62 and earlier

Description A sandbox bypass issue related to the handling of method names in method call expressions allows attackers to execute arbitrary code in sandboxed scripts.

Recommendations For Jenkins Script Security Plugin versions 1.62 and earlier, update to a version later than 1.62 to resolve the issue.

Correção

Identificadores relacionados

CVE-2019-10393

GHSA-9FP8-64XF-W957

RHSA-2019:4055

RHSA-2019:4089

RHSA-2019:4097

Produtos afetados

Jenkins

Jenkins Script Security Plugin

Referências · 8

• https://github.com/jenkinsci/script-security-plugin · Nota
• https://github.com/jenkinsci/script-security-plugin/commit/b28e4dc5584ef6515aeb9bc834691176546d0689 · Nota
• https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-9fp8-64xf-w957 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10393 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/09/12/2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10393 · Nota de Segurança
• https://t.me/cvenotify/22892 · Publicação no Telegram