Vulnerability Description
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Script Security | <= 1.64 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2019/10/01/2Mailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4055
- https://access.redhat.com/errata/RHSA-2019:4089
- https://access.redhat.com/errata/RHSA-2019:4097
- https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1579Vendor Advisory
- http://www.openwall.com/lists/oss-security/2019/10/01/2Mailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4055
- https://access.redhat.com/errata/RHSA-2019:4089
- https://access.redhat.com/errata/RHSA-2019:4097
- https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1579Vendor Advisory
FAQ
What is CVE-2019-10431?
CVE-2019-10431 is a vulnerability with a CVSS score of 9.9 (CRITICAL). A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code i...
How severe is CVE-2019-10431?
CVE-2019-10431 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-10431?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Script Security.