PT-2019-11788 · Jenkins · Jenkins Script Security Plugin+1

Nils Emmerich · Published 2019-09-12 · Updated 2023-10-25 · CVE-2019-10394

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1.62 and earlier

Description A sandbox bypass issue related to the handling of property names in property expressions on the left-hand side of assignment expressions allows attackers to execute arbitrary code in sandboxed scripts.

Recommendations For Jenkins Script Security Plugin versions 1.62 and earlier, update to a version later than 1.62 to resolve the issue.

Fix

Related Identifiers

CVE-2019-10394

GHSA-HVMX-5HV4-F235

RHSA-2019:4055

RHSA-2019:4089

RHSA-2019:4097

Affected Products

Jenkins

Jenkins Script Security Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2019-10394 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10394 · Security Note
• https://osv.dev/vulnerability/GHSA-hvmx-5hv4-f235 · Vendor Advisory
• https://github.com/jenkinsci/script-security-plugin · Note
• https://github.com/jenkinsci/script-security-plugin/commit/b28e4dc5584ef6515aeb9bc834691176546d0689 · Note
• http://openwall.com/lists/oss-security/2019/09/12/2 · Note