CVE-2022-43401

CWE-6937 documents7 sources
Severity
9.9CRITICAL
EPSS
0.2%
top 59.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Script Security PluginJenkins Script Security
Timeline
PublishedOct 19
Latest updateApr 15

Description

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 3.1 | Impact: 6.0

Affected Packages4 packages

▶CVEListV5jenkins_project/jenkins_script_security_pluginunspecified — 1183.v774b_0b_0a_a_451
▶Mavenorg.jenkins-ci.plugins:script-security< 1184.v85d16b_d851b_3
▶NVDjenkins/script_security1183.v774b_0b_0a_a_451

🔴Vulnerability Details

3
CVEList
CVE-2022-43401: A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183↗2022-10-19
▶
OSV
Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin↗2022-10-19
▶
GHSA
Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin↗2022-10-19
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Communications Risk Matrix: Installation (Jenkins Script Security) — CVE-2022-43401↗2023-04-15
▶
Red Hat
jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin↗2022-10-19
▶
Jenkins
Jenkins Security Advisory 2022-10-19↗2022-10-19
▶
CVE-2022-43401 (CRITICAL CVSS 9.9) | A sandbox bypass vulnerability invo | cvebase.io