Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/script-security/1229.v4880b_b_e905a_6/6d8dfb75093b8b8973af431a5fb129a91ce87525/script-security-1229.v4880b_b_e905a_6.jar
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/script-security/1229.v4880b_b_e905a_6/6d8dfb75093b8b8973af431a5fb129a91ce87525/script-security-1229.v4880b_b_e905a_6.jar
A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-34144
### Vulnerable Library - script-security-1229.v4880b_b_e905a_6.jar
Allows Jenkins administrators to control what in-process scripts can be run by less-privileged users.
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/script-security/1229.v4880b_b_e905a_6/6d8dfb75093b8b8973af431a5fb129a91ce87525/script-security-1229.v4880b_b_e905a_6.jar
A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Allows Jenkins administrators to control what in-process scripts can be run by less-privileged users.
Library home page: https://github.com/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/script-security/1229.v4880b_b_e905a_6/6d8dfb75093b8b8973af431a5fb129a91ce87525/script-security-1229.v4880b_b_e905a_6.jar
Found in HEAD commit: 26696d30ae3a174047ee21ec6573e9b8b0bc1d1e
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-34145
### Vulnerable Library - script-security-1229.v4880b_b_e905a_6.jarAllows Jenkins administrators to control what in-process scripts can be run by less-privileged users.
Library home page: https://github.com/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/script-security/1229.v4880b_b_e905a_6/6d8dfb75093b8b8973af431a5fb129a91ce87525/script-security-1229.v4880b_b_e905a_6.jar
Dependency Hierarchy: - :x: **script-security-1229.v4880b_b_e905a_6.jar** (Vulnerable Library)
Found in HEAD commit: 26696d30ae3a174047ee21ec6573e9b8b0bc1d1e
Found in base branch: main
### Vulnerability DetailsA sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Publish Date: 2024-05-02
URL: CVE-2024-34145
### CVSS 3 Score Details (8.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-34145
Release Date: 2024-05-02
Fix Resolution: org.jenkins-ci.plugins:script-security:1336.vf33a_a_9863911
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-34144
### Vulnerable Library - script-security-1229.v4880b_b_e905a_6.jarAllows Jenkins administrators to control what in-process scripts can be run by less-privileged users.
Library home page: https://github.com/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/script-security/1229.v4880b_b_e905a_6/6d8dfb75093b8b8973af431a5fb129a91ce87525/script-security-1229.v4880b_b_e905a_6.jar
Dependency Hierarchy: - :x: **script-security-1229.v4880b_b_e905a_6.jar** (Vulnerable Library)
Found in HEAD commit: 26696d30ae3a174047ee21ec6573e9b8b0bc1d1e
Found in base branch: main
### Vulnerability DetailsA sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Publish Date: 2024-05-02
URL: CVE-2024-34144
### CVSS 3 Score Details (8.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-34144
Release Date: 2024-05-02
Fix Resolution: org.jenkins-ci.plugins:script-security:1336.vf33a_a_9863911
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.