CVE-2019-10380: High severity jenkins vulnerability
Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.
Other sources
Jenkins Simple Travis Pipeline Runner Plugin defines a custom list of pre-approved signatures for scripts protected by the Script Security sandbox.
This custom list of pre-approved signatures allows the use of methods that can be used to bypass Script Security sandbox protection. This results in arbitrary code execution on any Jenkins instance with this plugin installed.
As of publication of this advisory, there is no fix.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10380?
CVE-2019-10380 is a vulnerability in the Jenkins Simple Travis Pipeline Runner Plugin that allows the bypass of Script Security sandbox protection.
What is the severity of CVE-2019-10380?
The severity of CVE-2019-10380 is rated as high with a CVSS score of 8.8.
Which software is affected by CVE-2019-10380?
Jenkins Simple Travis Pipeline Runner Plugin version 1.0 and earlier is affected by CVE-2019-10380.
How can CVE-2019-10380 be exploited?
CVE-2019-10380 can be exploited by using custom pre-approved signatures to bypass the Script Security sandbox protection in the plugin.
Are there any references available for CVE-2019-10380?
Yes, you can refer to the following links for more information about CVE-2019-10380: [Link 1](http://www.openwall.com/lists/oss-security/2019/08/07/1), [Link 2](https://jenkins.io/security/advisory/2019-08-07/#SECURITY-922), [Link 3](https://nvd.nist.gov/vuln/detail/CVE-2019-10380).