CVE-2022-43403

Published: Oct 19, 2022Modified: Jun 17, 2026

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: NVD

Description

A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Affected (1)

Products: Jenkins: Script Security

1 product

Script Security

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Script Security	Up to 1183.v774b_0b_0a_a_451

References (6)

http://www.openwall.com/lists/oss-security/2022/10/19/3

Source: jenkinsci-cert@googlegroups.com

Mailing ListThird Party Advisory

https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29

Source: jenkinsci-cert@googlegroups.com

Vendor Advisory

https://www.secpod.com/blog/oracle-releases-critical-security-updates-january-2023-patch-now/

Source: jenkinsci-cert@googlegroups.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2022/10/19/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.secpod.com/blog/oracle-releases-critical-security-updates-january-2023-patch-now/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.