| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:script-security | < 1.48 | 1.48 |
| script security | ≤ 1.47 | |
| openshift container platform | = 3.11 |
A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy sandbox are installed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free