PT-2019-2881 · Jenkins · Jenkins Script Security Plugin+1

Published 2019-07-31 · Updated 2023-10-25 · CVE-2019-10356

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1.61 and earlier

Description A sandbox bypass issue related to the handling of method pointer expressions allows attackers to execute arbitrary code in sandboxed scripts. The vulnerability is related to errors in data processing, which can be exploited by a remote attacker to execute arbitrary code.

Recommendations For Jenkins Script Security Plugin versions 1.61 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-466

CWE-254

Related Identifiers

BDU:2019-02850

CVE-2019-10356

GHSA-X25X-J4W4-7M59

RHSA-2019:2651

RHSA-2019:2662

Affected Products

Jenkins

Jenkins Script Security Plugin

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2019-10356 · Security Note
• https://bdu.fstec.ru/vul/2019-02850 · Security Note
• https://osv.dev/vulnerability/GHSA-x25x-j4w4-7m59 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2594 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2651 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2662 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10356 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20%282%29 · Note
• https://access.redhat.com/security/cve/cve-2019-10356 · Note
• https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20(2) · Note
• http://openwall.com/lists/oss-security/2019/07/31/1 · Note