CVE-2019-10356

CWE-466CWE-20 — Improper Input Validation8 documents7 sources
Severity
8.8HIGH
EPSS
0.0%
top 87.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Jenkins Script SecurityJenkins Project Jenkins Script Security PluginRedhat Openshift Container Platform
Timeline
PublishedJul 31
Latest updateMay 24

Description

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

Also affects: Openshift Container Platform 3.11, 4.1

🔴Vulnerability Details

3
GHSA
Return of Pointer Value Outside of Expected Rang in Jenkins Script Security Plugin↗2022-05-24
▶
OSV
Return of Pointer Value Outside of Expected Rang in Jenkins Script Security Plugin↗2022-05-24
▶
CVEList
CVE-2019-10356: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1↗2019-07-31
▶

📋Vendor Advisories

2
Red Hat
jenkins-plugin-script-security: Sandbox bypass through method pointer expressions in Script Security Plugin↗2019-08-01
▶
Jenkins
Jenkins Security Advisory 2019-07-31↗2019-07-31
▶

💬Community

2
Bugzilla
CVE-2019-10356 jenkins-plugin-script-security: Sandbox bypass through method pointer expressions in Script Security Plugin↗2019-08-01
▶
Bugzilla
CVE-2019-10356 jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox bypass through method pointer expressions in Script Security Plugin [fedora-all]↗2019-08-01
▶