CVE-2019-10380

Published: Aug 7, 2019Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.

Affected (1)

Products: Jenkins: Simple Travis Pipeline Runner

Jenkins

1 product

Simple Travis Pipeline Runner

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Simple Travis Pipeline Runner	Up to 1.0

References (4)

http://www.openwall.com/lists/oss-security/2019/08/07/1

Source: jenkinsci-cert@googlegroups.com

Mailing ListThird Party Advisory

https://jenkins.io/security/advisory/2019-08-07/#SECURITY-922

Source: jenkinsci-cert@googlegroups.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2019/08/07/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://jenkins.io/security/advisory/2019-08-07/#SECURITY-922

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.