PT-2019-11788 · Jenkins · Jenkins Script Security Plugin+1

Nils Emmerich · CVE-2019-10394 · Publicado 2019-09-12 · Atualizado 2023-10-25

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1.62 and earlier

Description A sandbox bypass issue related to the handling of property names in property expressions on the left-hand side of assignment expressions allows attackers to execute arbitrary code in sandboxed scripts.

Recommendations For Jenkins Script Security Plugin versions 1.62 and earlier, update to a version later than 1.62 to resolve the issue.

Correção

Identificadores relacionados

CVE-2019-10394

GHSA-HVMX-5HV4-F235

RHSA-2019:4055

RHSA-2019:4089

RHSA-2019:4097

Produtos afetados

Jenkins

Jenkins Script Security Plugin

Referências · 7

• https://github.com/jenkinsci/script-security-plugin · Nota
• https://github.com/jenkinsci/script-security-plugin/commit/b28e4dc5584ef6515aeb9bc834691176546d0689 · Nota
• https://osv.dev/vulnerability/CVE-2019-10394 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10394 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-hvmx-5hv4-f235 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/09/12/2 · Nota