Multiple vulnerabilities in Script Security plugin for Jenkins
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 4 |
| CVE-ID | CVE-2019-10393 CVE-2019-10394 CVE-2019-10399 CVE-2019-10400 |
| CWE-ID | CWE-264 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Script Security Web applications / Modules and components for CMS |
| Vendor | Jenkins |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
1) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU21119
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-10393
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper handling of method names in method call expressions. A remote authenticated attacker can specify and run sandboxed scripts to execute arbitrary code the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsScript Security: 1.0 - 1.62
External linkshttp://www.openwall.com/lists/oss-security/2019/09/12/2
http://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU21120
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-10394
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper handling of property names in property expressions on the left-hand side of assignment expressions. A remote authenticated attacker can specify and run sandboxed scripts to execute arbitrary code the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsScript Security: 1.0 - 1.62
External linkshttp://www.openwall.com/lists/oss-security/2019/09/12/2
http://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU21121
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-10399
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper handling of property names in property expressions in increment and decrement expressions. A remote authenticated attacker can specify and run sandboxed scripts to execute arbitrary code the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsScript Security: 1.0 - 1.62
External linkshttp://www.openwall.com/lists/oss-security/2019/09/12/2
http://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU21122
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-10400
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper handling of subexpressions in increment and decrement expressions not involving actual assignment allowed. A remote authenticated attacker can specify and run sandboxed scripts to execute arbitrary code the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsScript Security: 1.0 - 1.62
External linkshttp://www.openwall.com/lists/oss-security/2019/09/12/2
http://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
