Critical severity · published Oct 19, 2022
CVE-2022-43402
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier…
9.9
CVSS
1.5%
EPSS
No
On KEV
Description
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JP
Jenkins Pipeline: Groovy Plugin · Jenkins project
through 2802.v5ea_628154b_c2 · source: vendor
PG
Pipeline: Groovy · Jenkins
through 2802.v5ea_628154b_c2 · source: NVD
Affected product
JP
Jenkins Pipeline: Groovy Plugin
Jenkins project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43402
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43402
Mailing List
http://www.openwall.com/lists/oss-security/2022/10/19/3
Vendor Advisory
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29
More from Jenkins Pipeline: Groovy Plugin
9.9
CVE-2019-1003030
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
4.3
CVE-2026-57284
Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to…
4.3
CVE-2026-57283
A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or system…