CVE-2019-10306

A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execute arbitrary code on the Jenkins master JVM.

Score

CVSS 3.1 9.9 Critical

Status

Modified - jenkinsci-cert@googlegroups.com

Published

2019-04-18

Last modified

2024-08-04

Affected products

• Ontrack (Jenkins)
• Jenkins Ontrack Plugin (Jenkins Project)

References

• http://www.securityfocus.com/bid/108045
• https://jenkins.io/security/advisory/2019-04-17/#SECURITY-1341