VulnerabilityModified
CVE-2019-10393
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts.
MEDIUM 4.2EPSS 1.05%
Does this matter?
Lower severity and a low EPSS score (1.05%). Track it; it rarely justifies an emergency change on its own.
Description
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts.
- CVSS 3.1
- 4.2 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 1.05% probability · 62th percentile
- CISA KEV
- Not listed
- Affected
- jenkins/script security
- Source
- jenkinsci-cert@googlegroups.com
References
- http://www.openwall.com/lists/oss-security/2019/09/12/2Mailing List, Third Party Advisory
- https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538Vendor Advisory
- http://www.openwall.com/lists/oss-security/2019/09/12/2Mailing List, Third Party Advisory
- https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.