CVE-2017-1000505 — Sensitive Information Exposure in Jenkins Script Security

CWE-200 — Sensitive Information Exposure8 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 45.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Jenkins Script Security
Timeline
PublishedJan 25
Latest updateMay 14

Description

In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to create new `File` objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Such a type coercion is now subject to sandbox protection and considered to be a call to the `new File(String)` constructor for the purpose of in-process script approval.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

🔴Vulnerability Details

3
OSV
Exposure of Sensitive Information to an Unauthorized Actor Jenkins Script Security Plugin↗2022-05-14
▶
GHSA
Exposure of Sensitive Information to an Unauthorized Actor Jenkins Script Security Plugin↗2022-05-14
▶
CVEList
CVE-2017-1000505: In Jenkins Script Security Plugin version 1↗2018-01-25
▶

📋Vendor Advisories

2
Jenkins
Jenkins Security Advisory 2017-12-11↗2017-12-11
▶
Red Hat
jenkins-plugin-script-security: Arbitrary file read vulnerability in Script Security Plugin (SECURITY-663)↗2017-12-11
▶

💬Community

2
Bugzilla
CVE-2017-1000505 jenkins-script-security-plugin: jenkins-plugin-script-security: Arbitrary file read vulnerability in Script Security Plugin (SECURITY-663) [fedora-all]↗2017-12-12
▶
Bugzilla
CVE-2017-1000505 jenkins-plugin-script-security: Arbitrary file read vulnerability in Script Security Plugin (SECURITY-663)↗2017-12-12
▶
CVE-2017-1000505 — Sensitive Information Exposure | cvebase