High severity · published Dec 10, 2018
CVE-2018-1000866
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java,…
8.8
CVSS
1.6%
EPSS
No
On KEV
Description
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
Openshift Container Platform · Redhat
3.11 · source: NVD
PG
Pipeline: Groovy · Jenkins
through 2.59 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1000866
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1000866
Third Party Advisory
https://access.redhat.com/errata/RHBA-2019:0326
Third Party Advisory
https://access.redhat.com/errata/RHBA-2019:0327
Vendor Advisory
https://jenkins.io/security/advisory/2018-10-29/#SECURITY-1186
More from Pipeline: Groovy
9.9
CVE-2019-1003030
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
9.9
CVE-2022-43402
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier…
9.8
CVE-2019-1003041
A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts
8.8
CVE-2022-25173
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for…
8.8
CVE-2020-2109
Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods