CVE-2020-2279
Last modified
CVE-2020-2279 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide crafted return values or script binding content that can result in arbitrary code execution on the Jenkins controller JVM.. EPSS estimates a 2.13% chance of exploitation in the next 30 days.
Description
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide crafted return values or script binding content that can result in arbitrary code execution on the Jenkins controller JVM.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Script Security | <= 1.74 |
References
- http://www.openwall.com/lists/oss-security/2020/09/23/1Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/09/23/1Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-2279?
How severe is CVE-2020-2279?
How do I fix CVE-2020-2279?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-22781In Etherpad < 1.8.3, a specially crafted URI would raise an …7.5
- CVE-2020-22782Etherpad < 1.8.3 is affected by a denial of service in the i…7.5
- CVE-2020-22783Etherpad <1.8.3 stored passwords used by users insecurely in…6.5
- CVE-2020-22784In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing …7.5
- CVE-2020-22785Etherpad < 1.8.3 is affected by a missing lock check which c…7.5
- CVE-2020-22789Unauthenticated Stored XSS in FME Server versions 2019.2 and…6.1
- CVE-2020-22790Authenticated Stored XSS in FME Server versions 2019.2 and 2…5.4
- CVE-2020-2280A cross-site request forgery (CSRF) vulnerability in Jenkins…8.8
- CVE-2020-22807An issue was dicovered in vtiger crm 7.2. Union sql injectio…9.8
- CVE-2020-22808An issue was found in yii2_fecshop 2.x. There is a reflected…6.1
- CVE-2020-22809In Windscribe v1.83 Build 20, 'WindscribeService' has an Unq…7.8
- CVE-2020-2281A cross-site request forgery (CSRF) vulnerability in Jenkins…5.4
Are you affected by CVE-2020-2279?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST