CVE-2017-1000107

2017-10-0501:29:04

Google

osv.dev

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection.

CPENameOperatorVersion
script-security-plugineqscript-security-1.28
script-security-plugineqscript-security-1.5
script-security-plugineqscript-security-1.19
script-security-plugineqscript-security-1.9
script-security-plugineqscript-security-1.4
script-security-plugineqscript-security-1.18
script-security-plugineqscript-security-1.8
script-security-plugineqscript-security-1.20
script-security-plugineqscript-security-1.0-beta-4
script-security-plugineqscript-security-1.14

Name	Operator	Version
script-security-plugin	eq	script-security-1.28
script-security-plugin	eq	script-security-1.5
script-security-plugin	eq	script-security-1.19
script-security-plugin	eq	script-security-1.9
script-security-plugin	eq	script-security-1.4
script-security-plugin	eq	script-security-1.18
script-security-plugin	eq	script-security-1.8
script-security-plugin	eq	script-security-1.20
script-security-plugin	eq	script-security-1.0-beta-4
script-security-plugin	eq	script-security-1.14