CyberRota Analysis
AI-GeneratedThe Jenkins Script Security Plugin versions up to 1415.v9a_f9b_3a_c253d are vulnerable due to a flaw that allows an attacker to exploit the plugin's ability to download a JAR file from a specified URL twice, leading to the execution of arbitrary code within the Jenkins controller JVM. This vulnerability poses a significant risk to Jenkins instances where users can define classpath entries, potentially compromising the entire system. Organizations using affected versions of Jenkins should prioritize remediation to mitigate the risk of unauthorized code execution.
Original NVD Description
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.
Related CVEs
Other vulnerabilities affecting the same vendor(s)