CyberRota Analysis
AI-GeneratedThe Jenkins Script Security Plugin prior to version 1415.v9a_f9b_3a_c253d is vulnerable due to inadequate method checks in sandboxed scripts, which can be exploited by attackers with permissions to define and run these scripts. This flaw allows for the bypassing of sandbox protections, enabling the execution of arbitrary code within the Jenkins controller JVM. Organizations using Jenkins, particularly those allowing user-defined scripts, should prioritize addressing this vulnerability to mitigate potential risks.
Original NVD Description
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Related CVEs
Other vulnerabilities affecting the same vendor(s)