CVE-2018-1000058

Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java…

published February 9, 2018

CVSS
—
EPSS
3%
Percentile
85.0
In the wild
Unconfirmed
What it is

Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deserialization like readResolve implemented in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02567 · 85.0th percentile
Published
2018-02-09T23:00Z
EPSS history
Timeline
  • 09 FEB 23:00Z
    Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java…
    cvelistv5