{"id":"GHSA-xgjx-96v4-mqxx","summary":"Jenkins Script Security Plugin allows for Bypass of Groovy Sandbox Protection","details":"The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations.","aliases":["CVE-2016-3102"],"modified":"2025-03-13T19:28:47.181144Z","published":"2022-05-17T02:57:51Z","database_specific":{"cwe_ids":[],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-03-13T19:05:08Z","nvd_published_at":"2017-02-09T15:59:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3102"},{"type":"WEB","url":"https://github.com/jenkinsci/script-security-plugin/commit/e7d3bc9c1e25caa23cea33381134a4baaedc75b8"},{"type":"PACKAGE","url":"https://github.com/jenkinsci/script-security-plugin"},{"type":"WEB","url":"https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11"}],"affected":[{"package":{"name":"org.jenkins-ci.plugins:script-security","ecosystem":"Maven","purl":"pkg:maven/org.jenkins-ci.plugins/script-security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1"}]}],"versions":["1.0","1.0-beta-1","1.0-beta-2","1.0-beta-3","1.0-beta-4","1.0-beta-5","1.0-beta-6","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xgjx-96v4-mqxx/GHSA-xgjx-96v4-mqxx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}