PT-2019-11787 · Jenkins · Jenkins Script Security Plugin+1

Nils Emmerich · Published 2019-09-12 · Updated 2023-10-25 · CVE-2019-10393

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1.62 and earlier

Description A sandbox bypass issue related to the handling of method names in method call expressions allows attackers to execute arbitrary code in sandboxed scripts.

Recommendations For Jenkins Script Security Plugin versions 1.62 and earlier, update to a version later than 1.62 to resolve the issue.

Fix

Related Identifiers

CVE-2019-10393

GHSA-9FP8-64XF-W957

RHSA-2019:4055

RHSA-2019:4089

RHSA-2019:4097

Affected Products

Jenkins

Jenkins Script Security Plugin

References · 8

• https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9fp8-64xf-w957 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10393 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10393 · Security Note
• https://github.com/jenkinsci/script-security-plugin · Note
• https://github.com/jenkinsci/script-security-plugin/commit/b28e4dc5584ef6515aeb9bc834691176546d0689 · Note
• http://openwall.com/lists/oss-security/2019/09/12/2 · Note
• https://t.me/cvenotify/22892 · Telegram Post