CVE-2017-1000107
Last modified
CVE-2017-1000107 is a vulnerability of currently unknown severity. Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection.. EPSS estimates a 1.20% chance of exploitation in the next 30 days.
Description
Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Script Security | 1.30 |
References
- https://jenkins.io/security/advisory/2017-08-07/Vendor Advisory
- https://jenkins.io/security/advisory/2017-08-07/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-1000107?
How severe is CVE-2017-1000107?
How do I fix CVE-2017-1000107?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-1000101curl supports "globbing" of URLs, in which a user can pass a…6.5
- CVE-2017-1000102The Details view of some Static Analysis Utilities based plu…
- CVE-2017-1000103The custom Details view of the Static Analysis Utilities bas…
- CVE-2017-1000104The Config File Provider Plugin is used to centrally manage …
- CVE-2017-1000105The optional Run/Artifacts permission can be enabled by sett…
- CVE-2017-1000106Blue Ocean allows the creation of GitHub organization folder…
- CVE-2017-1000108The Pipeline: Input Step Plugin by default allowed users wit…
- CVE-2017-1000109The custom Details view of the Static Analysis Utilities bas…
- CVE-2017-1000110Blue Ocean allows the creation of GitHub organization folder…
- CVE-2017-1000111Linux kernel: heap out-of-bounds in AF_PACKET sockets. This …7.8
- CVE-2017-1000112Linux kernel: Exploitable memory corruption due to UFO to no…7
- CVE-2017-1000113The Deploy to container Plugin stored passwords unencrypted …
Are you affected by CVE-2017-1000107?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST