PT-2019-2579

CVE-2019-1003041

Publicado

2019-03-25

Atualizado

2023-10-25

Descrição por

CVSS 3.1

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Groovy Plugin versions 2.64 and earlier

Description The issue is related to a sandbox bypass vulnerability in the Jenkins Pipeline: Groovy Plugin, which is associated with incorrect type conversion. This allows attackers to invoke arbitrary constructors in sandboxed scripts, potentially enabling remote attackers to execute malicious actions.

Recommendations For Jenkins Pipeline: Groovy Plugin versions 2.64 and earlier, update to a version later than 2.64 to resolve the issue.

Explorabilidade

Correção

Impactos

Pesquisadores

Anthony Weems

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-704: Incorrect Type Conversion or Cast

CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\'Unsafe Reflection\')

Identificadores relacionados