CyberRota Analysis
AI-GeneratedThe Jenkins Script Security Plugin prior to version 1415.v9a_f9b_3a_c253d is vulnerable to arbitrary code execution due to improper handling of classpath entries when an item configuration is copied or updated by users with Overall/Administer permissions. This flaw allows attackers with the ability to define classpath entries to execute malicious code within the Jenkins controller's JVM. Organizations using Jenkins, particularly those with elevated user permissions, should prioritize addressing this vulnerability to mitigate potential exploitation risks.
Original NVD Description
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.
Related CVEs
Other vulnerabilities affecting the same vendor(s)