Jenkins Script Security Plugin Sandbox Bypass Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/04/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:script-security | < 1.54 | 1.54 |
| script security | ≤ 1.53 | |
| openshift container platform | = 3.11 |
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free