GHSA-m26f-w3h5-62fj

Sandbox bypass vulnerability in Jenkins Script Security Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10399

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:script-security	< 1.63	1.63

Details

As written in the advisory (Markdown source, shown as plain text).

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in increment and decrement expressions allowed attackers to execute arbitrary code in sandboxed scripts.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10399 advisory
https://github.com/jenkinsci/script-security-plugin/commit/b28e4dc5584ef6515aeb9bc834691176546d0689 web
https://github.com/jenkinsci/script-security-plugin package
https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538 web
http://www.openwall.com/lists/oss-security/2019/09/12/2 web