CVE-2024-34144

CWE-6936 documents6 sources
Severity
9.8CRITICAL
EPSS
50.1%
top 2.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Script Security PluginJenkins Script Security
Timeline
PublishedMay 2

Description

A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_script_security_plugin1335.vf07d9ce377a_e
▶NVDjenkins/script_security1335.vf07d9ce377a_e

🔴Vulnerability Details

3
CVEList
CVE-2024-34144: A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335↗2024-05-02
▶
GHSA
Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies↗2024-05-02
▶
OSV
Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies↗2024-05-02
▶

📋Vendor Advisories

2
Red Hat
jenkins-plugin/script-security: sandbox bypass via crafted constructor bodies↗2024-05-02
▶
Jenkins
Jenkins Security Advisory 2024-05-02↗2024-05-02
▶
CVE-2024-34144 (CRITICAL CVSS 9.8) | A sandbox bypass vulnerability invo | cvebase.io