A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Affected: Maven: org.jenkins-ci.plugins:script-security

A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) spring-security-oauth2-client: Privilege Escalation in spring-security-oauth2-client spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security apache-commons-text: variable interpolation RCE jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin haproxy: request smuggling attack in HTTP/1 header parsing Jenkins: XSS vulnerability in plugin manager Jenkins: Temporary plugin file created with insecure permissions Jenkins: Temporary file parameter created with insecure permissions Jenkins: Information disclosure through error stack traces related to agents

Ein entfernter, anonymer oder angemeldeter Angreifer kann mehrere Schwachstellen in Jenkins Plugins ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Cross-Site-Scripting-Angriff durchzuführen.