CVE-2022-43403: jenkins project jenkins script security plugin
Vulnerability summary
CVE-2022-43403 is a critical (CVSS 9.9) vulnerability in jenkins project jenkins script security plugin. EPSS estimates a 1.89% chance of exploitation in the next 30 days, higher than 79.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4Timeline
- 19-10-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVSS metrics
2 scores · 2 sources · 1 version- OSV · MavenEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
1.89%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
+0.35 pp
From 1.54% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Jenkins1 product
- script_security≤ 1183.v774b_0b_0a_a_451
Jenkins project1 product
- jenkins script security plugin≥ unspecified, ≤ 1183.v774b_0b_0a_a_451
Org.jenkins-ci.plugins1 product
- script-security< 1184.v85d16b_d851b_3
3 vendors · 3 products
References
6 links- www.jenkins.io/security/advisory/2022-10-19/Vendor Advisory
