CVE-2017-1000095
Last modified
CVE-2017-1000095 is a vulnerability of currently unknown severity. The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. EPSS estimates a 0.82% chance of exploitation in the next 30 days.
Description
The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Script Security | 1.34 |
References
- https://jenkins.io/security/advisory/2017-07-10/Vendor Advisory
- https://jenkins.io/security/advisory/2017-07-10/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-1000095?
How severe is CVE-2017-1000095?
How do I fix CVE-2017-1000095?
Are you affected by CVE-2017-1000095?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST