PT-2019-11794 · Jenkins · Jenkins Script Security Plugin+1

Nils Emmerich · Published 2019-09-12 · Updated 2023-10-25 · CVE-2019-10400

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1.62 and earlier

Description A sandbox bypass issue related to the handling of subexpressions in increment and decrement expressions not involving actual assignment allows attackers to execute arbitrary code in sandboxed scripts.

Recommendations For Jenkins Script Security Plugin versions 1.62 and earlier, update to a version later than 1.62 to resolve the issue.

Fix

Related Identifiers

CVE-2019-10400

GHSA-76Q7-R3G4-WVM4

RHSA-2019:4055

RHSA-2019:4089

RHSA-2019:4097

Affected Products

Jenkins

Jenkins Script Security Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-76q7-r3g4-wvm4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10400 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10400 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538 · Vendor Advisory
• https://github.com/jenkinsci/script-security-plugin · Note
• https://github.com/jenkinsci/script-security-plugin/commit/b28e4dc5584ef6515aeb9bc834691176546d0689 · Note
• http://openwall.com/lists/oss-security/2019/09/12/2 · Note