CVE-2024-34145 — Authentication Bypass by Spoofing in Project Jenkins Script Security Plugin

CWE-290 — Authentication Bypass by SpoofingCWE-693 — Protection Mechanism Failure6 documents6 sources
Severity
8.8HIGHNVD
EPSS
0.1%
top 81.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Script Security PluginJenkins Script Security
Timeline
PublishedMay 2

Description

A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5jenkins_project/jenkins_script_security_plugin1335.vf07d9ce377a_e
▶NVDjenkins/script_security1335.vf07d9ce377a_e

🔴Vulnerability Details

3
CVEList
CVE-2024-34145: A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 13↗2024-05-02
▶
GHSA
Jenkins Script Security Plugin sandbox bypass vulnerability↗2024-05-02
▶
OSV
Jenkins Script Security Plugin sandbox bypass vulnerability↗2024-05-02
▶

📋Vendor Advisories

2
Red Hat
jenkins-plugin/script-security: sandbox bypass via sandbox-defined classes↗2024-05-02
▶
Jenkins
Jenkins Security Advisory 2024-05-02↗2024-05-02
▶
CVE-2024-34145 — Authentication Bypass by Spoofing | cvebase