VDB
CVE-2019-10431
CVE-2019-10431
PUBLISHED
CVSS 9.899999618530273 CRITICAL
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.
EPSS 2.75% · 85.9th percentile
Risk Scores
CVSS 3.1
9.899999618530273
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score
2.75%
85.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins project | Jenkins Script Security Plugin | 1.64 and earlier |
| jenkins | script_security | 0 |
| Maven | org.jenkins-ci.plugins:script-security | 0 |
Timeline
- Oct 1, 2019 CVE Published
- Oct 9, 2019 CVE Updated
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Dec 29, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 1, 2022 EPSS Score
- May 3, 2022 EPSS Score
- Jul 5, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
References
- https://github.com/jenkinsci/script-security-plugin/commit/415b6e2f3fa0c2e4bd2f9c4a589a9e1fc9cbac8b fix
- https://github.com/jenkinsci/script-security-plugin/blob/7bd58b8635709cecdb50018844e5d6dbe1ce13ea/CHANGELOG.md exploit
- https://access.redhat.com/errata/RHSA-2019:4055 advisory
- https://access.redhat.com/errata/RHSA-2019:4097 advisory
- https://access.redhat.com/errata/RHSA-2019:4089 advisory
- [oss-security] 20191001 Multiple vulnerabilities in Jenkins plugins mailing-list
- https://nvd.nist.gov/vuln/detail/CVE-2019-10431 advisory
- https://github.com/jenkinsci/script-security-plugin package
- https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1579 advisory