CVE-2016-3102
HighSummary
The Script Security plugin in Jenkins before version 1.18.1 may allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs direct field access or get/set array operations.
Risk Assessment
The organization may be exposed to unauthorized data access or execution of malicious code, potentially leading to serious security incidents.
Recommendation
It is recommended to update the Script Security plugin to version 1.18.1 or later to mitigate this vulnerability.
Other vulnerabilities in Jenkins Script Security plugin
See all- CVE-2026-84659Unknown
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.
- CVE-2026-84658Unknown
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration.
- CVE-2026-57281High
Jenkins Script Security Plugin version 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.
Original NVD description (English source)
The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations.