CVE-2024-34144

critical · 9.8

A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

9.8

CVSS

48.1%

EPSS (exploit prob.)

99th

EPSS percentile

2024-05-02

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-693

Affected products

Vendor	Product	Affected versions
jenkins	script_security	<= 1335.vf07d9ce377a_e

Check a specific version with /api/v1/cve/match.

References

http://www.openwall.com/lists/oss-security/2024/05/02/3
https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3341
http://www.openwall.com/lists/oss-security/2024/05/02/3
https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3341

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-34144