-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:script-security | maven | <= 1.62 | 1.63 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper sandbox validation of two key areas: 1) Property name resolution in increment/decrement expressions (CVE-2019-10399 specifically calls out this vector), and 2) General method/property name validation in assignment contexts. The commit patching this updated groovy-sandbox to v1.23 and added tests showing rejection of malicious patterns like 't.({...}())++' and '++({...}())'. The tests in SandboxInterceptorTest.java demonstrate scenarios where property names and subexpressions in postfix/prefix operations could execute restricted methods like Jenkins.getInstance(). The vulnerable functions are in the sandbox interceptor logic handling these expression types.
KEV Misses 88% of Exploited CVEs- Get the report