Critical severity · published Oct 1, 2019
CVE-2019-10431
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to…
9.9
CVSS
2.8%
EPSS
No
On KEV
Description
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Script Security · Jenkins
through 1.64 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10431
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10431
Mailing List
http://www.openwall.com/lists/oss-security/2019/10/01/2
access.redhat.com
https://access.redhat.com/errata/RHSA-2019:4055
access.redhat.com
https://access.redhat.com/errata/RHSA-2019:4089
access.redhat.com
https://access.redhat.com/errata/RHSA-2019:4097
Vendor Advisory
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1579
More from Script Security
9.9
CVE-2019-1003029
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
9.9
CVE-2022-43401
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier…
9.9
CVE-2022-43403
A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with…
9.9
CVE-2022-43404
A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451…
9.9
CVE-2020-2279
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide crafted return values or…