CVE-2016-3102: High severity Jenkins Script Security Jenkins vulnerability
Published Feb 9, 2017
·Updated
The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations.
Affected Software
20 affected componentsFixes available
Jenkins Script Security Jenkins=1.0
Jenkins Script Security Jenkins=1.1
Jenkins Script Security Jenkins=1.2
Jenkins Script Security Jenkins=1.3
Jenkins Script Security Jenkins=1.4
Jenkins Script Security Jenkins=1.5
Jenkins Script Security Jenkins=1.6
Jenkins Script Security Jenkins=1.7
Jenkins Script Security Jenkins=1.8
Jenkins Script Security Jenkins=1.9
Jenkins Script Security Jenkins=1.10
Jenkins Script Security Jenkins=1.11
Jenkins Script Security Jenkins=1.12
Jenkins Script Security Jenkins=1.13
Jenkins Script Security Jenkins=1.14
Jenkins Script Security Jenkins=1.15
Jenkins Script Security Jenkins=1.16
Jenkins Script Security Jenkins=1.17
Jenkins Script Security Jenkins=1.18
maven/org.jenkins-ci.plugins:script-security<1.18.1
1.18.1
Event History
Feb 9, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
via NVD·03:59 PM
DescriptionSeverityWeaknessAffected Software
May 17, 2022
Advisory Published
via GitHub·02:57 AM
Data Sourced
via GitHub·02:57 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-3102?
CVE-2016-3102 is classified as a medium severity vulnerability.
2
How do I fix CVE-2016-3102?
To fix CVE-2016-3102, upgrade the Script Security plugin to version 1.18.1 or later.
3
Who is affected by CVE-2016-3102?
CVE-2016-3102 affects installations of Jenkins with Script Security plugin versions prior to 1.18.1.
4
What type of vulnerability is CVE-2016-3102?
CVE-2016-3102 is a sandbox bypass vulnerability that allows attackers to execute unauthorized script operations.
5
Can CVE-2016-3102 be exploited remotely?
Yes, CVE-2016-3102 can be exploited by remote attackers due to the nature of the sandbox bypass.