What is GHSA-xgjx-96v4-mqxx?

GHSA-xgjx-96v4-mqxx is a security advisory published by GitHub Security Advisories with High severity. Jenkins Script Security Plugin allows for Bypass of Groovy Sandbox Protection

Which CVE IDs does GHSA-xgjx-96v4-mqxx cover?

GHSA-xgjx-96v4-mqxx covers the following CVE IDs: CVE-2016-3102. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xgjx-96v4-mqxx?

GHSA-xgjx-96v4-mqxx has a CVSS v3 base score of 7.3, published by GitHub Security Advisories.

Which products are affected by GHSA-xgjx-96v4-mqxx?

GHSA-xgjx-96v4-mqxx affects 1 product, including: maven/org.jenkins-ci.plugins:script-security:\u003c 1.18.1.

GHSA-xgjx-96v4-mqxxHighCVSS 7.3

Jenkins Script Security Plugin allows for Bypass of Groovy Sandbox Protection

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

March 13, 2025

🔗 CVE IDs covered (1)

CVE-2016-3102 →

📋 Description

The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations.

🎯 Affected products1

maven/org.jenkins-ci.plugins:script-security:< 1.18.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2016-3102
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11
https://github.com/jenkinsci/script-security-plugin/commit/e7d3bc9c1e25caa23cea33381134a4baaedc75b8
https://github.com/advisories/GHSA-xgjx-96v4-mqxx