Jenkins Script Security Plugin Sandbox Bypass via Array Casting
CVE-2022-43403 Published on October 19, 2022
A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Products Associated with CVE-2022-43403
Want to know whenever a new CVE is published for Jenkins Script Security? stack.watch will email you.
Affected Versions
Jenkins project Jenkins Script Security Plugin:- Version 1175.1177.vda_175b_77d144 is unaffected.
- Version unspecified, <= 1183.v774b_0b_0a_a_451 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.