CVE-2023-24422

2023-01-2621:18:16

Alpine Linux Development Team

security.alpinelinux.org

jenkins

script security plugin

sandbox bypass

arbitrary code

vulnerability

unix

8.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

5.1%

JSON

A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

OSVersionArchitecturePackageVersionFilename
Alpine3.17-communitynoarchjenkins= 2.361.2-r0UNKNOWN
Alpine3.18-communitynoarchjenkins= 2.387.3-r0UNKNOWN
Alpineedge-communitynoarchjenkins= 2.440.2-r0UNKNOWN
Alpine3.19-communitynoarchjenkins= 2.440.3-r0UNKNOWN
Alpine3.20-communitynoarchjenkins= 2.440.2-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	3.17-community	noarch	jenkins	= 2.361.2-r0	UNKNOWN
Alpine	3.18-community	noarch	jenkins	= 2.387.3-r0	UNKNOWN
Alpine	edge-community	noarch	jenkins	= 2.440.2-r0	UNKNOWN
Alpine	3.19-community	noarch	jenkins	= 2.440.3-r0	UNKNOWN
Alpine	3.20-community	noarch	jenkins	= 2.440.2-r0	UNKNOWN