-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability centers around improper sandboxing of method pointer expressions. The primary vulnerable function is the method call interceptor that handles Groovy method pointer expressions (MethodPointerExpression). The security advisory explicitly states method pointer subexpressions weren't subject to sandbox checks, which would be handled in the core sandbox interception logic. The BlacklistedMethodSignature matcher is included due to its role in method validation, where improper matching could allow bypasses. The high confidence for SandboxInterceptor comes from its direct responsibility for method call validation, while the BlacklistedMethodSignature has medium confidence as a supporting component.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:script-security | maven | <= 1.61 | 1.62 |
KEV Misses 88% of Exploited CVEs- Get the report