1. Home
  2. Vulnerabilities
  3. CVE-2023-24422

CVE-2023-24422

CVSS v3.1 8.8 (High)
88% Progress
EPSS 0.04 % (13th)
0.04% Progress
Affected Products 1
Advisories 2
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Weaknesses
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE Status
PUBLISHED
CNA
Jenkins Project
Published Date
2023-01-26 21:18:16
(20 months ago)
Updated Date
2023-02-04 02:08:29
(19 months ago)

Affected Products

Jenkins

Configuration #1

    CPE23 From Up To
  Jenkins Script Security for Jenkins prior 1229.v4880b_b_e905a_6 version cpe:2.3:a:jenkins:script_security::*:*:*:*:jenkins < 1229.v4880b_b_e905a_6