CVE-2022-43403: Critical severity Jenkins Script Security Jenkins vulnerability

Published Oct 19, 2022
·
Updated

A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b0b0aa451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Other sources

A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.

Affected Software

7 affected componentsFixes available
redhat/jenkins<2-plugins-0:4.11.1683009941-1.el8
2-plugins-0:4.11.1683009941-1.el8
redhat/jenkins<2-plugins-0:4.12.1675702407-1.el8
2-plugins-0:4.12.1675702407-1.el8
redhat/jenkins<2-plugins-0:4.10.1675144701-1.el8
2-plugins-0:4.10.1675144701-1.el8
redhat/jenkins<2-plugins-0:4.9.1675668922-1.el8
2-plugins-0:4.9.1675668922-1.el8
maven/org.jenkins-ci.plugins:script-security<1184.v85d16b
1184.v85d16b_d851b_3
redhat/Script Security Plugin<1184.
1184.
Jenkins Script Security Jenkins<=1183.v774b_0b_0a_a_451

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 2-plugins-0:4.11.1683009941-1.el8
  2. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 2-plugins-0:4.12.1675702407-1.el8
  3. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 2-plugins-0:4.10.1675144701-1.el8
  4. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 2-plugins-0:4.9.1675668922-1.el8
  5. Upgrade

    Upgrade maven/org.jenkins-ci.plugins:script-security to a version that resolves this vulnerability.

    Fixed in 1184.v85d16b_d851b_3
  6. Upgrade

    Upgrade redhat/Script Security Plugin to a version that resolves this vulnerability.

    Fixed in 1184.

Event History

Oct 19, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityAffected Software
Advisory Published
07:00 PM
Oct 20, 2022
Data Sourced
via Red Hat·06:29 AM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2022-43403?

CVE-2022-43403 is considered a high severity vulnerability due to its ability to allow attackers to bypass sandbox protections.

2

How do I fix CVE-2022-43403?

To fix CVE-2022-43403, upgrade to Jenkins Script Security Plugin version 1184.v85d16b or later.

3

What versions of Jenkins are affected by CVE-2022-43403?

CVE-2022-43403 affects Jenkins Script Security Plugin versions up to and including 1183.v774b_0b_0a_a_451.

4

What type of vulnerability is CVE-2022-43403?

CVE-2022-43403 is a sandbox bypass vulnerability that can lead to arbitrary code execution.

5

Who can exploit CVE-2022-43403?

Attackers with permission to define and run sandboxed scripts in Jenkins can exploit CVE-2022-43403.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203