CVE-2019-10380 - Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code

Back Back to CVE browser

HIGH

Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code

Published Aug 7, 2019

8.8

HIGH

CVSS 3.1

EPSS 1.76%

Description

Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.

Affected products

Vendor Jenkins project Product Jenkins Simple Travis Pipeline Runner Plugin Default
n/a
- Version
  1.0 and earlier
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins Simple Travis Pipeline Runner Plugin

n/a

Version	Status	Constraints
1.0 and earlier	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (4)

http://www.openwall.com/lists/oss-security/2019/08/07/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://github.com/advisories/GHSA-x7p9-vx6v-wv84
Advisory
https://jenkins.io/security/advisory/2019-08-07/#SECURITY-922
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10380

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/08/07/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://github.com/advisories/GHSA-x7p9-vx6v-wv84		Advisory
https://jenkins.io/security/advisory/2019-08-07/#SECURITY-922		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10380