In breve
- CVE-2019-1003032 è una vulnerabilità CRITICO (CVSS 9.9) che riguarda org.jenkins-ci.plugins:email-ext, email extension (jenkins).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.4%, superiore al 84.3% delle vulnerabilità.
- Correzione: aggiornare a 2.65 o successiva.
Description
A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
NVD description
A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
Altre vulnerabilità di org.jenkins-ci.plugins:email-ext
Vedi tutto →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free