CVE-2020-2279
First published: Wed Sep 23 2020(Updated: )
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide crafted return values or script binding content that can result in arbitrary code execution on the Jenkins controller JVM.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Script Security | <=1.74 | |
| maven/org.jenkins-ci.plugins:script-security | <1.66.5 | 1.66.5 |
| maven/org.jenkins-ci.plugins:script-security | >=1.67<1.75 | 1.75 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2020/09/23/1
- https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-2020
- https://nvd.nist.gov/vuln/detail/CVE-2020-2279
- https://github.com/CVEProject/cvelist/blob/16860a328d970faa6e4350b0fa446f64a52e52ca/2020/2xxx/CVE-2020-2279.json
- https://github.com/jenkinsci/script-security-plugin/commit/79d1e9207c5c359ca779b92f0a290e18c5e2387b
- https://github.com/advisories/GHSA-ccr8-4xr7-cgj3 (Advisory)
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-2279.
What is the severity of CVE-2020-2279?
The severity of CVE-2020-2279 is critical with a CVSS score of 9.9.
What is Jenkins Script Security Plugin?
Jenkins Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute.
How does the vulnerability in Jenkins Script Security Plugin affect users?
The vulnerability in Jenkins Script Security Plugin allows attackers to bypass the sandbox and execute arbitrary code.
How can I mitigate the vulnerability in Jenkins Script Security Plugin?
To mitigate the vulnerability, users should upgrade Jenkins Script Security Plugin to version 1.75 or later.
- collector/nvd-index
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-ccr8-4xr7-cgj3
- alias/CVE-2020-2279
- collector/github-advisory
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- agent/trending
- vendor/jenkins
- canonical/jenkins script security
- version/jenkins script security/1.74
- package-manager/maven