GHSA-mqc2-w9r8-mmxm

Suggest an improvement
Source
https://github.com/advisories/GHSA-mqc2-w9r8-mmxm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-mqc2-w9r8-mmxm/GHSA-mqc2-w9r8-mmxm.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-mqc2-w9r8-mmxm
Aliases
Published
2022-10-19T19:00:21Z
Modified
2026-08-24T00:35:16Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution
Details

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Pipeline: Groovy Plugin 2803.v1a_f77ffcc773 intercepts Groovy casts performed implicitly by the Groovy language runtime

Database specific 
{
    "cwe_ids": [
        "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-19T22:04:22Z",
    "nvd_published_at": "2022-10-19T16:15:00Z",
    "severity": "CRITICAL"
}
References

Affected packages

Maven / org.jenkins-ci.plugins.workflow:workflow-cps

Package

Name
org.jenkins-ci.plugins.workflow:workflow-cps
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2803.v1a_f77ffcc773

Affected versions

0.*
0.1-beta-1
0.1-beta-2
0.1-beta-3
0.1-beta-4
0.1-beta-5
0.1-beta-6
0.1-beta-7
0.1-beta-8
1.*
1.0-beta-1
1.0
1.1
1.2
1.3
1.4
1.4.1
1.4.2
1.4.3-beta-1
1.4.3
1.5
1.6-alpha-1
1.6
1.7-alpha-1
1.7
1.8
1.9-beta-1
1.9
1.10-beta-1
1.10
1.10.1
1.11-beta-1
1.11-beta-2
1.11-beta-3
1.11-beta-4
1.11
1.12-beta-1
1.12-beta-2
1.12-beta-3
1.12
1.13
1.14-beta-1
1.14
1.14.1-beta-1
1.14.1
1.14.2
1.15-beta-1
1.15
2.*
2.0
2.1
2.2
2.3
2.4
2.5
2.6
2.7
2.8
2.9
2.10
2.11
2.12
2.13
2.14
2.15
2.16
2.17
2.18
2.19
2.20
2.21
2.22
2.23
2.24
2.25
2.26
2.27
2.28
2.29
2.30
2.30-stepstorage2-alpha
2.30-stepstorage2-alpha2
2.30-stepstorage4-beta
2.31
2.32
2.33
2.34
2.35
2.36
2.36.1
2.37
2.38
2.39
2.40
2.41
2.42
2.43
2.43-durability-beta-1
2.43-durability-beta-2
2.43-durability-beta-3
2.43-durability-beta-4
2.44
2.45
2.46
2.46.1
2.46.2
2.47
2.48
2.49
2.50
2.51
2.52
2.53
2.54
2.54.1
2.54.2
2.55
2.56
2.57
2.57.1
2.57.2
2.57.3
2.58-beta-1
2.58
2.59
2.60
2.61
2.61.1
2.61.2
2.61.3
2.62
2.63
2.64
2.65
2.66
2.66.1
2.67
2.68
2.69
2.70
2.71
2.72
2.73
2.74
2.74.1
2.75
2.76
2.77
2.78
2.79
2.80
2.81
2.82
2.83
2.84
2.85
2.86
2.87
2.88
2.89
2.90
2.91
2.92
2.92.1
2.93
2.94
2.94.1
2.94.4
2633.*
2633.v6baeedc13805
2640.*
2640.v00e79c8113de
2644.*
2644.v29a793dac95a
2646.*
2646.v6ed3b5b01ff1
2648.*
2648.va9433432b33c
2648.2651.v230593e03e9f
2656.*
2656.vf7a_e7b_75a_457
2659.*
2659.v52d3de6044d0
2660.*
2660.vb_c0412dc4e6d
2660.2664.v4c114e93f4c1
2680.*
2680.vf642ed4fa_d55
2682.*
2682.va_473dcddc941
2683.*
2683.vd0a_8f6a_1c263
2683.2687.vb_0cc3f973f06
2686.*
2686.v7c37e0578401
2687.*
2687.v3f09155513c1
2688.*
2688.v39a_b_e5c49a_65
2689.*
2689.v434009a_31b_f1
2692.*
2692.v76b_089ccd026
2705.*
2705.v0449852ee36f
2706.*
2706.v71dd22b_c5a_a_2
2710.*
2710.vcd48b_b_9e0e7d
2725.*
2725.v7b_c717eb_12ce
2729.*
2729.vea_17b_79ed57a_
2729.2732.vda_e3f07b_5a_f8
2746.*
2746.v0da_83a_332669
2746.2748.v365128b_c26d7
2759.*
2759.v87459c4eea_ca_
2759.2761.vd6e8d2a_15980
2784.*
2784.vd252824b_4eb_9
2801.*
2801.vf82a_b_b_e3e8a_5
2802.*
2802.v5ea_628154b_c2

Database specific

last_known_affected_version_range 
"< 2803.v1a"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-mqc2-w9r8-mmxm/GHSA-mqc2-w9r8-mmxm.json"