CWE Code: 269
Vulnerability Type: privilege_escalation
CVSS Score: 6.5
CWE Name:  Improper Privilege Management
Summary: a sandbox bypass vulnerability exists in pipeline: groovy plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/sandboxtransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/sandboxcpstransformer.java that allows attackers with job/configure permission, or unauthorized attackers with scm commit privileges and corresponding pipelines based on jenkinsfiles set up in jenkins, to execute arbitrary code on the jenkins master jvm
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2018-12-10
Last Modified Date: 2019-10-03