⚠ Actively exploited
Added to CISA KEV on 2022-04-25. Federal agencies required to patch by 2022-05-16. Required action: Apply updates per vendor instructions..
Severity
9.9CRITICAL
EPSS
92.6%
top 0.25%
CISA KEV
KEV
Added 2022-04-25
Due 2022-05-16
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedMar 8
KEV addedApr 25
Latest updateMay 13
KEV dueMay 16
CISA Required Action: Apply updates per vendor instructions.
Description
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 3.1 | Impact: 6.0
Affected Packages3 packages
Also affects: Openshift Container Platform 3.11