CVE-2022-43403

EPSS 0.3%
Published 19.10.2022 16:15:10
Last modified 21.11.2024 07:26:24
Source jenkinsci-cert@googlegroups.co
Teams watchlist Login
Open Login

A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Affected products Warnungen 0 Metrics 2 CWE 0 References 6

Data is provided by the National Vulnerability Database (NVD)

Jenkins ≫ Script Security SwPlatformjenkins Version <= 1183.v774b_0b_0a_a_451

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.3%	0.527

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.9	3.1	6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

http://www.openwall.com/lists/oss-security/2022/10/19/3

Third Party Advisory

Mailing List

https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29

Vendor Advisory

https://www.secpod.com/blog/oracle-releases-critical-security-updates-january-2023-patch-now/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2022-43403

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-43403

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-43403

EUVD