Groovy
Monthly
Authorization bypass in Rundeck through 6.2.1 lets an authenticated user who holds only the 'import' action on a target project tamper with that project's configuration - including security-relevant settings such as node executors and SSH key paths - by abusing the unauthenticated importConfig and importNodesSources parameters of the project archive import endpoint. The attacker gains no direct code execution, but the rewritten configuration is consumed by later job runs, so the realized impact depends on whether the affected project executes jobs that rely on the tampered executor or SSH settings; the independent assessment rates this as a genuine, moderately-high-priority flaw (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) rather than an inflated score. Exploitation requires valid credentials with the import capability (authenticated, low privilege) and no public exploit has been identified at time of analysis; authentication requirements are confirmed as low-privileged from the CVSS vector (PR:L).
Apache Groovy provides extension methods to aid with creating temporary directories. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 69.7%.
Authorization bypass in Rundeck through 6.2.1 lets an authenticated user who holds only the 'import' action on a target project tamper with that project's configuration - including security-relevant settings such as node executors and SSH key paths - by abusing the unauthenticated importConfig and importNodesSources parameters of the project archive import endpoint. The attacker gains no direct code execution, but the rewritten configuration is consumed by later job runs, so the realized impact depends on whether the affected project executes jobs that rely on the tampered executor or SSH settings; the independent assessment rates this as a genuine, moderately-high-priority flaw (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) rather than an inflated score. Exploitation requires valid credentials with the import capability (authenticated, low privilege) and no public exploit has been identified at time of analysis; authentication requirements are confirmed as low-privileged from the CVSS vector (PR:L).
Apache Groovy provides extension methods to aid with creating temporary directories. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 69.7%.