{"id":"CVE-2017-1000505","published":"2018-01-25T18:00:00Z","modified":"2024-09-16T17:08:44Z","title":"In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to create new `File` objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Such a type coercion is now subject to sandbox protection and considered to be a call to the `new File(String)` constructor for the purpose of in-process script approval.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00994,"percentile":0.62511,"provenance":"source"},"cwes":[],"references":[{"url":"https://jenkins.io/security/advisory/2017-12-11/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":12.5,"factors":[{"name":"EPSS percentile","points":12.5}]},"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","vulnerableRanges":["<1.37"],"patched":["1.37"],"from":["GHSA-r9jf-hf9x-7hrv"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5137","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2016-3102","published":"2017-02-09","fixed":"1.18.1","kev":false},{"cve":"CVE-2017-1000095","published":"2017-10-04","fixed":"1.29.1","kev":false},{"cve":"CVE-2017-1000107","published":"2017-10-04","fixed":"1.31","kev":false,"link":{"from":"CVE-2017-1000107","to":"CVE-2017-1000505","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:script-security","fromFixed":"1.31","toFixed":"1.37","daysApart":113}]}},{"cve":"CVE-2017-1000505","published":"2018-01-25","fixed":"1.37","kev":false},{"cve":"CVE-2018-1000865","published":"2018-12-10","fixed":"1.48","kev":false,"link":{"from":"CVE-2017-1000505","to":"CVE-2018-1000865","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:script-security","fromFixed":"1.37","toFixed":"1.48","daysApart":319}]}},{"cve":"CVE-2018-1000866","published":"2018-12-10","fixed":"1.48","kev":false,"link":{"from":"CVE-2017-1000505","to":"CVE-2018-1000866","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:script-security","fromFixed":"1.37","toFixed":"1.48","daysApart":319}]}},{"cve":"CVE-2019-1003000","published":"2019-01-22","fixed":"1.50","kev":false}],"package":"Maven:org.jenkins-ci.plugins:script-security"}}