CVE-2020-2135 (High) detected in script-security-1.66.jar
Opened this issue · 0 comments
CVE-2020-2135 - High Severity Vulnerability
Vulnerable Library - script-security-1.66.jar
Allows Jenkins administrators to control what in-process scripts can be run by less-privileged users.
Library home page: https://wiki.jenkins.io/display/JENKINS/Script+Security+Plugin
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/jenkins-ci/plugins/script-security/1.66/script-security-1.66.jar
Dependency Hierarchy:
- git-4.2.1.jar (Root Library)
- ❌ script-security-1.66.jar (Vulnerable Library)
Found in HEAD commit: 97ed2b7fe477b78f0b26191e5950825314db7b2c
Found in base branch: master
Vulnerability Details
Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterceptable.
Publish Date: 2020-03-09
URL: CVE-2020-2135
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2135
Release Date: 2020-03-10
Fix Resolution: org.jenkins-ci.plugins:script-security:1.71
Step up your Open Source Security Game with Mend here