The Jenkins Script Security Plugin does not enforce a permission check on the method that controls the global "Force the use of the sandbox" setting. By sending a Stapler data binding payload, an attacker can disable the sandbox globally, allowing Groovy scripts to execute with complete system privileges on the Jenkins host. This can lead to disclosure of sensitive information, modification of configurations, and potential further compromise of the underlying operating system.

All installations of the Jenkins Script Security Plugin version 1412.v7737b_3405f86 and earlier, regardless of the operating system, are potentially affected. The vulnerability exists in the Jenkins Project’s Script Security Plugin, which is used by Jenkins instances with the default configuration of this plug‑in.

The CVSS score of 4.3 indicates a moderate risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is neither widely reported nor actively used by known adversaries at this time. The likely attack vector is via HTTP, as the Stapler framework processes form data submitted to the Jenkins web interface. An attacker who can supply a crafted request (e.g., a POST to /script-security/settings) may modify the sandbox enforcement setting without proper authorization, provided they have any authenticated access that can bind Stapler parameters.