CVE-2022-43404 — Protection Mechanism Failure in Project Jenkins Script Security Plugin

CWE-693 — Protection Mechanism Failure6 documents6 sources
Severity
9.9CRITICALNVD
EPSS
0.1%
top 64.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Script Security PluginJenkins Script Security
Timeline
PublishedOct 19

Description

A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 3.1 | Impact: 6.0

Affected Packages2 packages

▶CVEListV5jenkins_project/jenkins_script_security_pluginunspecified — 1183.v774b_0b_0a_a_451
▶NVDjenkins/script_security1183.v774b_0b_0a_a_451

🔴Vulnerability Details

3
OSV
Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin↗2022-10-19
▶
GHSA
Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin↗2022-10-19
▶
CVEList
CVE-2022-43404: A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security P↗2022-10-19
▶

📋Vendor Advisories

2
Red Hat
jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin↗2022-10-19
▶
Jenkins
Jenkins Security Advisory 2022-10-19↗2022-10-19
▶
CVE-2022-43404 — Protection Mechanism Failure | cvebase