Em resumo
- CVE-2019-1003032 é uma vulnerabilidade CRÍTICO (CVSS 9.9) que afeta org.jenkins-ci.plugins:email-ext, email extension (jenkins).
- Chance de exploração nos próximos 30 dias (EPSS): 2.4%, maior que 84.3% das vulnerabilidades.
- Correção: atualize para 2.65 ou posterior.
Description
A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
NVD description
A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
Mais vulnerabilidades de org.jenkins-ci.plugins:email-ext
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free