by Kastro
Paper/Archive/CVE-2024-34144

CVE-2024-34144

Jenkins Project Jenkins Script Security Plugin — A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier all…

EPSS 48%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.9.989 × 2019.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Affected

ProductAffectedFixed inSource
Jenkins Script Security Plugin≤ 1335.vf07d9ce377a_e–CNA
script_security≤ 1335.vf07d9ce377a_e–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryjenkins.io/security/advisory/2024-05-02/#SECURITY-3341refopenwall.com/lists/oss-security/2024/05/02/3