CVE-2020-2279

Published: Sep 23, 2020Modified: Jun 17, 2026

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: NVD

Description

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide crafted return values or script binding content that can result in arbitrary code execution on the Jenkins controller JVM.

Affected (1)

Products: Jenkins: Script Security

1 product

Script Security

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Script Security	Up to 1.74

References (4)

http://www.openwall.com/lists/oss-security/2020/09/23/1

Source: jenkinsci-cert@googlegroups.com

Third Party Advisory

https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-2020

Source: jenkinsci-cert@googlegroups.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2020/09/23/1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-2020

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.