CVE-2022-43402

EPSS 0.1%
Veröffentlicht 19.10.2022 16:15:10
Zuletzt bearbeitet 21.11.2024 07:26:24
Quelle jenkinsci-cert@googlegroups.co
Teams Watchlist Login
Unerledigt Login

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Jenkins ≫ Pipeline: Groovy SwPlatformjenkins Version <= 2802.v5ea_628154b_c2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.1%	0.276

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.9	3.1	6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

http://www.openwall.com/lists/oss-security/2022/10/19/3

Third Party Advisory

Mailing List

https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2022-43402

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-43402

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-43402

EUVD