CVE-2020-2110: Input Validation
Published Feb 12, 2020
·Updated
Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
Affected Software
2 affected componentsFixes available
maven/org.jenkins-ci.plugins:script-security<=1.69
1.70
Jenkins Script Security Jenkins<=1.69
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.plugins:script-securityto a version that resolves this vulnerability.Fixed in 1.70
Event History
Feb 12, 2020
CVE Published
via MITRE·02:35 PM
Data Sourced
via MITRE·02:35 PM
Description
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
May 24, 2022
Advisory Published
05:08 PM
Frequently Asked Questions
1
What is the severity of CVE-2020-2110?
The severity of CVE-2020-2110 is high with a CVSS score of 8.8.
2
How can the sandbox protection be circumvented in Jenkins Script Security Plugin 1.69 and earlier?
The sandbox protection can be circumvented by applying AST transforming annotations to imports or by using them inside of other annotations during the script compilation phase.