CVE-2022-43404: jenkins project jenkins script security plugin
Vulnerability summary
CVE-2022-43404 is a critical (CVSS 9.9) vulnerability in jenkins project jenkins script security plugin. EPSS estimates a 1.39% chance of exploitation in the next 30 days, higher than 71.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4Timeline
- 19-10-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVSS metrics
2 scores · 2 sources · 1 version- OSV · MavenEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
1.39%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
+0.21 pp
From 1.18% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Jenkins1 product
- script_security≤ 1183.v774b_0b_0a_a_451
Jenkins project1 product
- jenkins script security plugin≥ unspecified, ≤ 1183.v774b_0b_0a_a_451
Org.jenkins-ci.plugins1 product
- script-security< 1184.v85d16b_d851b_3
Org.jenkins-ci.plugins.workflow1 product
- workflow-cps< 2803.v1a_f77ffcc773
4 vendors · 4 products
References
4 links- www.jenkins.io/security/advisory/2022-10-19/Vendor Advisory
