Attestkeep
Langue : Français
S'inscrire

Vulnérabilités / CVE-2022-43401

critique

CVE-2022-43401

jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin

Publiée Modifiée
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.

Sévérité par source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GHSA8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Le label propre à Trivy est CRITICAL. Critique selon NVD, Red Hat. Plus basse selon GHSA (élevée).

Description

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Paquets affectés et versions corrigées

SourcePaquetCorrigé en
Red Hatjenkins-2-pluginspas de correctif indiqué
maven::GitHub Security Advisory Mavenorg.jenkins-ci.plugins.workflow:workflow-cps, org.jenkins-ci.plugins:script-security2803.v1a_f77ffcc773 et 1 autres
Afficher les 3 entrées de 2 sources
SourcePaquetCorrigé en
Red Hatjenkins-2-pluginspas de correctif indiqué
maven::GitHub Security Advisory Mavenorg.jenkins-ci.plugins.workflow:workflow-cps2803.v1a_f77ffcc773
maven::GitHub Security Advisory Mavenorg.jenkins-ci.plugins:script-security1184.v85d16b_d851b_3

Références

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.