Jenkins Script Security vulnerabilities
45 known vulnerabilities affecting jenkins/script_security.
Total CVEs
45
CISA KEV
1
actively exploited
Public exploits
3
Exploited in wild
2
Severity breakdown
CRITICAL8HIGH25MEDIUM12
Vulnerabilities
Page 3 of 3
CVE-2026-84658P4MEDIUMCVSS 4.3≤ 1412.v7737b_3405f862026-09-02
CVE-2026-84658 [MEDIUM] CWE-200 CVE-2026-84658: Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` anno
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration.
nvd
CVE-2026-84659P4MEDIUMCVSS 4.3≤ 1412.v7737b_3405f862026-09-02
CVE-2026-84659 [MEDIUM] CWE-862 CVE-2026-84659: Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check i
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.
nvd
CVE-2024-52549P4MEDIUMCVSS 4.3fixed in 1362.1364.v4cf2dc5d8776≥ 1366.vd44b_49a_5c85c, < 1367.vdf2fc45f229c+1 more2024-11-13
CVE-2024-52549 [MEDIUM] CWE-862 CVE-2024-52549: Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ a
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.
nvd
CVE-2026-42519P4MEDIUMCVSS 4.3≤ 1399.ve6a_66547f6e12026-04-29
CVE-2026-42519 [MEDIUM] CWE-862 CVE-2026-42519: A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows
A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
nvd
CVE-2022-30946P4MEDIUMCVSS 4.3fixed in 1172.v35f6a_0b_8207e2022-05-17
CVE-2022-30946 [MEDIUM] CWE-352 CVE-2022-30946: A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_6
A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver.
nvd
← Previous3 / 3