CVE-2019-10390: High severity jenkins vulnerability
A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.4 and earlier allowed attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Other sources
Jenkins Splunk Plugin has a form validation HTTP endpoint used to validate a user-submitted Groovy script through compilation, which was not subject to sandbox protection. This allowed attackers with Overall/Read access to execute arbitrary code on the Jenkins controller by applying AST transforming annotations such as @Grab to source code elements.
The affected HTTP endpoint now applies a safe Groovy compiler configuration preventing the use of unsafe AST transforming annotations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10390?
CVE-2019-10390 has a high severity rating due to its potential for arbitrary code execution on the Jenkins master JVM.
How do I fix CVE-2019-10390?
To fix CVE-2019-10390, upgrade the Jenkins Splunk Plugin to version 1.8.0 or later.
What versions are affected by CVE-2019-10390?
CVE-2019-10390 affects Jenkins Splunk Plugin versions up to and including 1.7.4.
What type of vulnerability is CVE-2019-10390?
CVE-2019-10390 is classified as a sandbox bypass vulnerability.
Who can exploit CVE-2019-10390?
Attackers with Overall/Read permission in Jenkins can exploit CVE-2019-10390.