cbcvebase.
CVE-2020-2109
published 2020-02-12

CVE-2020-2109: Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.

PriorityP343high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.27%
66.5th percentile
Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.

Affected

24 ranges
VendorProductVersion rangeFixed in
jenkinsapplatix_plugin——
jenkinsbmc_release_package_and_deployment_plugin——
jenkinsdigitalocean_plugin——
jenkinsdynamic_extended_choice_parameter_plugin——
jenkinseagle_tester_plugin——
jenkinsecx_copy_data_management_plugin——
jenkinsfitnesse_plugin——
jenkinsgit_parameter_plugin——
jenkinsgoogle_kubernetes_engine_plugin——
jenkinsgroovy_plugin——
jenkinsharvest_scm_plugin——
jenkinsids_in_pipeline_github_notify_step_plugin——
jenkinsids_to_allow_users_configuring_the_plugin——
jenkinsnunit_plugin——
jenkinsparasoft_environment_manager_plugin——
jenkinspipeline<= 2.78—
jenkinspipeline_github_notify_step_plugin——
jenkinsradargun_plugin——
jenkinss3_publisher_plugin——
jenkinssandbox_protection_in_script_security_plugin——
jenkinsscript_security_plugin——
jenkinssubversion_plugin——
jenkinsyaml_input_files_to_google_kubernetes_engine_plugin——
jenkins_projectjenkins_pipeline_groovy_pluginunspecified – 2.78—

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.