Vulnerabilities > CVE-2022-43401 - Unspecified vulnerability in Jenkins Script Security

CVSS 9.9 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

jenkins

critical

NVD

Published: 2022-10-19

Updated: 2023-11-22

Summary

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Vulnerable Configurations

Part	Description	Count
Application	Jenkins Jenkins Script Security 1.0 Jenkins Script Security 1.1 Jenkins Script Security 1.2 Jenkins Script Security 1.3 Jenkins Script Security 1.4 Jenkins Script Security 1.5 Jenkins Script Security 1.6 Jenkins Script Security 1.7 Jenkins Script Security 1.8 Jenkins Script Security 1.9 Jenkins Script Security 1.10 Jenkins Script Security 1.11 Jenkins Script Security 1.12 Jenkins Script Security 1.13 Jenkins Script Security 1.14 Jenkins Script Security 1.15 Jenkins Script Security 1.16 Jenkins Script Security 1.17 Jenkins Script Security 1.18 Jenkins Script Security 1.18.1 Jenkins Script Security 1.19 Jenkins Script Security 1.20 Jenkins Script Security 1.21 Jenkins Script Security 1.22 Jenkins Script Security 1.23 Jenkins Script Security 1.24 Jenkins Script Security 1.25 Jenkins Script Security 1.26 Jenkins Script Security 1.27 Jenkins Script Security 1.28 Jenkins Script Security 1.29 Jenkins Script Security 1.29.1 Jenkins Script Security 1.30 Jenkins Script Security 1.31 Jenkins Script Security 1.32 Jenkins Script Security 1.33 Jenkins Script Security 1.34 Jenkins Script Security 1.35 Jenkins Script Security 1.36 Jenkins Script Security 1.37 Jenkins Script Security 1.38 Jenkins Script Security 1.39 Jenkins Script Security 1.40 Jenkins Script Security 1.41 Jenkins Script Security 1.42 Jenkins Script Security 1.43 Jenkins Script Security 1.44 Jenkins Script Security 1.44.1 Jenkins Script Security 1.45 Jenkins Script Security 1.46 Jenkins Script Security 1.46.1 Jenkins Script Security 1.47 Jenkins Script Security 1.48 Jenkins Script Security 1.49 Jenkins Script Security 1.50 Jenkins Script Security 1.51 Jenkins Script Security 1.52 Jenkins Script Security 1.53 Jenkins Script Security 1.54 Jenkins Script Security 1.54.1 Jenkins Script Security 1.54.2 Jenkins Script Security 1.54.3 Jenkins Script Security 1.54.4 Jenkins Script Security 1.55 Jenkins Script Security 1.56 Jenkins Script Security 1.57 Jenkins Script Security 1.57.1 Jenkins Script Security 1.57.2 Jenkins Script Security 1.57.3 Jenkins Script Security 1.57.4 Jenkins Script Security 1.57.5 Jenkins Script Security 1.57.6 Jenkins Script Security 1.58 Jenkins Script Security 1.59 Jenkins Script Security 1.60 Jenkins Script Security 1.60.1 Jenkins Script Security 1.61 Jenkins Script Security 1.62 Jenkins Script Security 1.63 Jenkins Script Security 1.63.1 Jenkins Script Security 1.64 Jenkins Script Security 1.65 Jenkins Script Security 1.66 Jenkins Script Security 1.66.1 Jenkins Script Security 1.66.2 Jenkins Script Security 1.66.3 Jenkins Script Security 1.66.4 Jenkins Script Security 1.66.5 Jenkins Script Security 1.67 Jenkins Script Security 1.68 Jenkins Script Security 1.69 Jenkins Script Security 1.70 Jenkins Script Security 1.71 Jenkins Script Security 1.72 Jenkins Script Security 1.73 Jenkins Script Security 1.74 Jenkins Script Security 1.75 Jenkins Script Security 1.76 Jenkins Script Security 1.77 Jenkins Script Security 1.78 Jenkins Script Security 1.78.1 Jenkins Script Security 1118.Vba21Ca2E3286 Jenkins Script Security 1125.V132F99385E1B_ Jenkins Script Security 1131.V8B_B_5Eda_C328E Jenkins Script Security 1138.V8E727069A_025 Jenkins Script Security 1140.Vf967Fb_Efa_55A_ Jenkins Script Security 1145.1148.Vf6D17A_A_A_Eef6 Jenkins Script Security 1145.Vb_Cf6Cf6Ed960 Jenkins Script Security 1146.Vdf547F19A_473 Jenkins Script Security 1158.V7C1B_73A_69A_08 Jenkins Script Security 1172.V35F6A_0B_8207E Jenkins Script Security 1175.1177.Vda_175B_77D144 Jenkins Script Security 1175.1179.Vea_F7532629E1 Jenkins Script Security 1175.V4B_D517D6Db_F0 Jenkins Script Security 1183.V774B_0B_0A_A_451	122

Summary

Vulnerable Configurations

References