Jenkins Script Security Plugin
Monthly
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier allows any low-privileged authenticated Jenkins user to disable the 'Force the use of the sandbox globally in the system' security control via a missing permission check exposed through Stapler data binding. The CVSS score of 4.3 reflects only the direct act of altering a setting, but the chained real-world risk is substantially higher: disabling global sandbox enforcement removes the primary defense against unrestricted Groovy execution, enabling subsequent RCE by any user with script authorship rights. No public exploit has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Improper use of the @DataBoundConstructor annotation in Jenkins Script Security Plugin versions ≤1412.v7737b_3405f86 enables low-privileged authenticated users to read the plugin's script approval configuration by submitting certain Jenkins forms. The flaw allows enumeration of which Groovy scripts, methods, and signatures have been approved for execution - information that could assist an attacker in mapping permitted scripted operations within the Jenkins environment. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis.
Sandbox escape in Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier allows users permitted to run sandboxed Groovy scripts to execute arbitrary code outside the sandbox. The plugin fails to reject Groovy AST transformation annotations that carry an 'extensions' member, so an attacker can point that member at a suitable class already on the evaluating component's classpath and have it run outside sandbox restrictions. No public exploit identified at time of analysis, and SSVC exploitation status is 'none'; EPSS is low at 0.39%.
Sandbox bypass in the Jenkins Script Security Plugin (1402.v94c9ce464861 and earlier) lets users who can supply sandboxed Groovy scripts invoke arbitrary constructors, escaping the sandbox to run unrestricted code on the Jenkins controller. The flaw stems from the plugin failing to intercept implicit type casts on elements of typed for-each loops, a subtle gap in its interception logic. Reported by the Jenkins project (SECURITY-3792) with no public exploit identified at time of analysis; EPSS is low at 0.37% and CISA SSVC records no observed exploitation.
Jenkins Script Security Plugin versions up to and including 1399.ve6a_66547f6e1 expose classpath enumeration to any user holding the low-privilege Overall/Read permission due to a missing authorization check (CWE-862). Any authenticated Jenkins user can query pending and approved Script Security classpaths without elevated rights, leaking internal class names, library paths, and approved script configuration useful for targeted reconnaissance. No public exploit exists and EPSS sits at 0.03% (7th percentile), placing this firmly in the low-urgency tier despite its network-reachable vector.
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier allows any low-privileged authenticated Jenkins user to disable the 'Force the use of the sandbox globally in the system' security control via a missing permission check exposed through Stapler data binding. The CVSS score of 4.3 reflects only the direct act of altering a setting, but the chained real-world risk is substantially higher: disabling global sandbox enforcement removes the primary defense against unrestricted Groovy execution, enabling subsequent RCE by any user with script authorship rights. No public exploit has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Improper use of the @DataBoundConstructor annotation in Jenkins Script Security Plugin versions ≤1412.v7737b_3405f86 enables low-privileged authenticated users to read the plugin's script approval configuration by submitting certain Jenkins forms. The flaw allows enumeration of which Groovy scripts, methods, and signatures have been approved for execution - information that could assist an attacker in mapping permitted scripted operations within the Jenkins environment. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis.
Sandbox escape in Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier allows users permitted to run sandboxed Groovy scripts to execute arbitrary code outside the sandbox. The plugin fails to reject Groovy AST transformation annotations that carry an 'extensions' member, so an attacker can point that member at a suitable class already on the evaluating component's classpath and have it run outside sandbox restrictions. No public exploit identified at time of analysis, and SSVC exploitation status is 'none'; EPSS is low at 0.39%.
Sandbox bypass in the Jenkins Script Security Plugin (1402.v94c9ce464861 and earlier) lets users who can supply sandboxed Groovy scripts invoke arbitrary constructors, escaping the sandbox to run unrestricted code on the Jenkins controller. The flaw stems from the plugin failing to intercept implicit type casts on elements of typed for-each loops, a subtle gap in its interception logic. Reported by the Jenkins project (SECURITY-3792) with no public exploit identified at time of analysis; EPSS is low at 0.37% and CISA SSVC records no observed exploitation.
Jenkins Script Security Plugin versions up to and including 1399.ve6a_66547f6e1 expose classpath enumeration to any user holding the low-privilege Overall/Read permission due to a missing authorization check (CWE-862). Any authenticated Jenkins user can query pending and approved Script Security classpaths without elevated rights, leaking internal class names, library paths, and approved script configuration useful for targeted reconnaissance. No public exploit exists and EPSS sits at 0.03% (7th percentile), placing this firmly in the low-urgency tier despite its network-reachable vector.