CVE-2018-1000861

Known exploited
Public exploit
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
Max CVSS
10.0
EPSS Score
97.34%
Published
2018-12-10
Updated
2022-06-13
CISA KEV Added
2022-02-10

CVE-2019-1003005

Public exploit
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Max CVSS
8.8
EPSS Score
0.47%
Published
2019-02-06
Updated
2023-10-25

CVE-2019-1003029

Known exploited
Public exploit
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
Max CVSS
9.9
EPSS Score
0.94%
Published
2019-03-08
Updated
2023-10-25
CISA KEV Added
2022-04-25
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!