A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: jenkins

Published: 2024-05-02T13:28:03.226Z

Updated: 2024-08-02T02:42:59.914Z

Reserved: 2024-04-30T20:53:08.611Z

Link: CVE-2024-34144

cve-icon Vulnrichment

Updated: 2024-08-02T02:42:59.914Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-05-02T14:15:10.280

Modified: 2024-07-03T01:59:25.760

Link: CVE-2024-34144

cve-icon Redhat

Severity : Important

Publid Date: 2024-05-02T00:00:00Z

Links: CVE-2024-34144 - Bugzilla