{"id":"CVE-2016-3102","published":"2017-02-09T15:00:00Z","modified":"2024-08-05T23:47:56Z","title":"The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection…","vendor":null,"product":null,"tier":"tail","description":{"text":"The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01769,"percentile":0.78048,"provenance":"source"},"cwes":[],"references":[{"url":"https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11","tags":["x_refsource_CONFIRM"]}],"priority":{"score":15.6,"factors":[{"name":"EPSS percentile","points":15.61}]},"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","vulnerableRanges":["<1.18.1"],"patched":["1.18.1"],"from":["GHSA-xgjx-96v4-mqxx"],"provenance":"source"}],"euvd":{"id":"EUVD-2016-4157","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-jenkins-script-security-plugin-cve-2016-3102","children":[{"from":"CVE-2016-3102","to":"CVE-2019-1003040","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/main/resources/org/jenkinsci/plugins/scriptsecurity/sandbox/whitelists/generic-whitelist"],"commits":["https://github.com/jenkinsci/script-security-plugin/commit/e7d3bc9c1e25caa23cea33381134a4baaedc75b8","https://github.com/jenkinsci/script-security-plugin/commit/8424ad90547e37a2bd3b6a3a7da48eb1af9cd0ee"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-2134","published":"2020-03-09","fixed":"1.7.1","kev":false},{"cve":"CVE-2016-3102","published":"2017-02-09","fixed":"1.18.1","kev":false},{"cve":"CVE-2017-1000095","published":"2017-10-04","fixed":"1.29.1","kev":false,"link":{"from":"CVE-2016-3102","to":"CVE-2017-1000095","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:script-security","fromFixed":"1.18.1","toFixed":"1.29.1","daysApart":237}]}},{"cve":"CVE-2017-1000107","published":"2017-10-04","fixed":"1.31","kev":false},{"cve":"CVE-2017-1000505","published":"2018-01-25","fixed":"1.37","kev":false}],"package":"Maven:org.jenkins-ci.plugins:script-security"}}