CVE-2017-1000505: Infoleak
In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to create new File objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Such a type coercion is now subject to sandbox protection and considered to be a call to the new File(String) constructor for the purpose of in-process script approval.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000505?
CVE-2017-1000505 is classified as a high severity vulnerability due to its potential to allow unauthorized file access.
How do I fix CVE-2017-1000505?
To fix CVE-2017-1000505, upgrade the Jenkins Script Security Plugin to version 1.37 or later.
What impact does CVE-2017-1000505 have on Jenkins installations?
CVE-2017-1000505 allows users to read arbitrary files on the Jenkins master file system, compromising data confidentiality.
Who is affected by CVE-2017-1000505?
CVE-2017-1000505 affects users who can configure sandboxed Groovy scripts in Jenkins installations running an affected version of the Script Security Plugin.
Is my Jenkins installation vulnerable to CVE-2017-1000505?
Your Jenkins installation is vulnerable to CVE-2017-1000505 if you are using Script Security Plugin version 1.36 or earlier.