{"id":"CVE-2016-3102","details":"The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations.","aliases":["GHSA-xgjx-96v4-mqxx"],"modified":"2026-07-08T12:42:18.703908Z","published":"2017-02-09T15:59:01.003Z","references":[{"type":"ADVISORY","url":"https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/script-security-plugin","events":[{"introduced":"acc9ebe61a89792e7654fa30f52b7ef788f31f21"},{"last_affected":"36e53d8ea23fa042071252877a74e824a6d314aa"}],"database_specific":{"extracted_events":[{"introduced":"1.0"},{"last_affected":"1.0"},{"introduced":"1.1"},{"last_affected":"1.1"},{"introduced":"1.2"},{"last_affected":"1.2"},{"introduced":"1.3"},{"last_affected":"1.3"},{"introduced":"1.4"},{"last_affected":"1.4"},{"introduced":"1.5"},{"last_affected":"1.5"},{"introduced":"1.6"},{"last_affected":"1.6"},{"introduced":"1.7"},{"last_affected":"1.7"},{"introduced":"1.8"},{"last_affected":"1.8"},{"introduced":"1.9"},{"last_affected":"1.9"},{"introduced":"1.10"},{"last_affected":"1.10"},{"introduced":"1.11"},{"last_affected":"1.11"},{"introduced":"1.12"},{"last_affected":"1.12"},{"introduced":"1.13"},{"last_affected":"1.13"},{"introduced":"1.14"},{"last_affected":"1.14"},{"introduced":"1.15"},{"last_affected":"1.15"},{"introduced":"1.16"},{"last_affected":"1.16"},{"introduced":"1.17"},{"last_affected":"1.17"},{"introduced":"1.18"},{"last_affected":"1.18"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:jenkins:script_security:1.0:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.1:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.2:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.3:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.4:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.5:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.6:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.7:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.8:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.9:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.10:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.11:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.12:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.13:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.14:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.15:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.16:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.17:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:script_security:1.18:*:*:*:*:jenkins:*:*"]}}],"versions":["1.0","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9","script-security-1.18","script-security-1.17","script-security-1.16","script-security-1.15","script-security-1.14","script-security-1.13","script-security-1.12","script-security-1.11","script-security-1.10","script-security-1.9","script-security-1.8","script-security-1.7","script-security-1.6","script-security-1.5","script-security-1.4","script-security-1.3","script-security-1.2","script-security-1.1","script-security-1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-3102.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}