GHSA-fm3j-r98g-97jh
Jenkins Groovy Plugin sandbox bypass vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:groovy | < 2.2 | 2.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, `src/main/java/hudson/plugins/groovy/StringScriptSource.java` that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. Groovy Plugin 2.2 uses Script Security APIs that apply sandbox protection during these phases.
References
External links from the advisory. They lead to third-party sites.