CVE-2020-2279 - A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide crafted return values or script binding content that can result in arbitrary code execution on the Jenkins controller JVM

Back Back to CVE browser

CRITICAL

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide crafted return values or script binding content that can result in arbitrary code execution on the Jenkins controller JVM

Published Sep 23, 2020

9.9

CRITICAL

CVSS 3.1

EPSS 2.13%

Description

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide crafted return values or script binding content that can result in arbitrary code execution on the Jenkins controller JVM.

Affected products

Vendor Jenkins project Product Jenkins Script Security Plugin Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=1.74
- Version
  1.66.5
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins Script Security Plugin

n/a

Version	Status	Constraints
unspecified	affected	<=1.74
1.66.5	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-693

References (7)

http://www.openwall.com/lists/oss-security/2020/09/23/1
mailing-listx_refsource_MLISTThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3563
Advisory
https://github.com/CVEProject/cvelist/blob/16860a328d970faa6e4350b0fa446f64a52e52ca/2020/2xxx/CVE-2020-2279.json
https://github.com/advisories/GHSA-ccr8-4xr7-cgj3
Advisory
https://github.com/jenkinsci/script-security-plugin/commit/79d1e9207c5c359ca779b92f0a290e18c5e2387b
https://nvd.nist.gov/vuln/detail/CVE-2020-2279
https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-2020
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2020/09/23/1		mailing-listx_refsource_MLISTThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3563		Advisory
https://github.com/CVEProject/cvelist/blob/16860a328d970faa6e4350b0fa446f64a52e52ca/2020/2xxx/CVE-2020-2279.json
https://github.com/advisories/GHSA-ccr8-4xr7-cgj3		Advisory
https://github.com/jenkinsci/script-security-plugin/commit/79d1e9207c5c359ca779b92f0a290e18c5e2387b
https://nvd.nist.gov/vuln/detail/CVE-2020-2279
https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-2020		x_refsource_CONFIRMVendor Advisory