Permissions, Privileges, and Access Controls in Script Security - CVE-2019-10356

Vulnerability identifier: #VU21566

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-10356

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to the sandbox protection can be circumvented through crafted subexpressions used as arguments to method pointer expressions. A remote authenticated attacker who is able to specify sandboxed scripts can execute arbitrary code in the context of the Jenkins master JVM.

Script Security

Install updates from vendor's website.

Script Security - update to 1.62

• http://www.openwall.com/lists/oss-security/2019/07/31/1
• https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20(2)

• Multiple vulnerabilities in Script Security plugin for Jenkins