Vulnerability Description
Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Simple Travis Pipeline Runner | <= 1.0 |
References
- http://www.openwall.com/lists/oss-security/2019/08/07/1Mailing ListThird Party Advisory
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-922Vendor Advisory
- http://www.openwall.com/lists/oss-security/2019/08/07/1Mailing ListThird Party Advisory
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-922Vendor Advisory
FAQ
What is CVE-2019-10380?
CVE-2019-10380 is a vulnerability with a CVSS score of 8.8 (HIGH). Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to ex...
How severe is CVE-2019-10380?
CVE-2019-10380 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-10380?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Simple Travis Pipeline Runner.