CVE-2022-43403

CWE-6937 documents7 sources
Severity
9.9CRITICAL
EPSS
0.3%
top 48.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Script Security PluginJenkins Script Security
Timeline
PublishedOct 19
Latest updateJan 15

Description

A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 3.1 | Impact: 6.0

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_script_security_pluginunspecified — 1183.v774b_0b_0a_a_451
▶Mavenorg.jenkins-ci.plugins:script-security< 1184.v85d16b_d851b_3
▶NVDjenkins/script_security1183.v774b_0b_0a_a_451

🔴Vulnerability Details

3
GHSA
Jenkins Script Security Plugin sandbox bypass vulnerability↗2022-10-19
▶
OSV
Jenkins Script Security Plugin sandbox bypass vulnerability↗2022-10-19
▶
CVEList
CVE-2022-43403: A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183↗2022-10-19
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Communications Risk Matrix: Signaling (Jenkins Script) — CVE-2022-43403↗2023-01-15
▶
Red Hat
jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin↗2022-10-19
▶
Jenkins
Jenkins Security Advisory 2022-10-19↗2022-10-19
▶
CVE-2022-43403 (CRITICAL CVSS 9.9) | A sandbox bypass vulnerability invo | cvebase.io