High severityNVD Advisory· Published Jan 24, 2023· Updated Apr 2, 2025

CVE-2023-24422

Description

A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:script-securityMaven	< 1229.v4880b	1229.v4880b

Affected products

ghsa-coords
pkg:maven/org.jenkins-ci.plugins/script-security
Range: < 1229.v4880b
Jenkins Project/Script Securitycpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-76qj-9gwh-pvv3ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-24422ghsaADVISORY
github.com/jenkinsci/script-security-plugin/commit/4880bbe905a6783d80150c8b881d0127430d4a73ghsaWEB
www.jenkins.io/security/advisory/2023-01-24/ghsaWEB

News mentions

Jenkins Security Advisory 2023-01-24
Jenkins Security Advisories · Jan 24, 2023

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000