CVE-2016-3102

The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.3 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 15%
VendorProductVersion
jenkinsscript_security
1.0
jenkinsscript_security
1.1
jenkinsscript_security
1.2
jenkinsscript_security
1.3
jenkinsscript_security
1.4
jenkinsscript_security
1.5
jenkinsscript_security
1.6
jenkinsscript_security
1.7
jenkinsscript_security
1.8
jenkinsscript_security
1.9
jenkinsscript_security
1.10
jenkinsscript_security
1.11
jenkinsscript_security
1.12
jenkinsscript_security
1.13
jenkinsscript_security
1.14
jenkinsscript_security
1.15
jenkinsscript_security
1.16
jenkinsscript_security
1.17
jenkinsscript_security
1.18
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
jenkins
zesty
dne
yakkety
dne
xenial
dne
wily
dne
trusty
dne
precise
ignored
Common Weakness Enumeration
References
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11