Vulnerability Description
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.
CVSS Score
8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Script Security | <= 1.67 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2019/11/21/1Mailing ListThird Party Advisory
- https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1658Vendor Advisory
- http://www.openwall.com/lists/oss-security/2019/11/21/1Mailing ListThird Party Advisory
- https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1658Vendor Advisory
FAQ
What is CVE-2019-16538?
CVE-2019-16538 is a vulnerability with a CVSS score of 8.8 (HIGH). A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sa...
How severe is CVE-2019-16538?
CVE-2019-16538 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-16538?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Script Security.