Headline
GHSA-7845-crfj-phc4: Script security bypass vulnerability in Jenkins Shared Library Version Override Plugin
Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they’re not executed in the Script Security sandbox, allowing attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection. This allows attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection. Shared Library Version Override Plugin 19.v3a_c975738d4a_ declares folder-scoped library overrides as untrusted, so that they’re executed in the Script Security sandbox.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-52554
Script security bypass vulnerability in Jenkins Shared Library Version Override Plugin
High severity GitHub Reviewed Published Nov 13, 2024 to the GitHub Advisory Database • Updated Nov 14, 2024
Package
maven io.jenkins.plugins:shared-library-version-override (Maven)
Affected versions
< 19.v3a
Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they’re not executed in the Script Security sandbox, allowing attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection. This allows attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection. Shared Library Version Override Plugin 19.v3a_c975738d4a_ declares folder-scoped library overrides as untrusted, so that they’re executed in the Script Security sandbox.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-52554
- https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3466
Published to the GitHub Advisory Database
Nov 13, 2024
Last updated
Nov 14, 2024