CVE-2016-3102

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-3102
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-3102.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-3102
Aliases
Published
2017-02-09T15:59:01.003Z
Modified
2026-07-08T12:42:18.703908Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations.

References

Affected packages

Git / github.com/jenkinsci/script-security-plugin

Affected ranges

Type
GIT
Repo
https://github.com/jenkinsci/script-security-plugin
Events
Introduced
acc9ebe61a89792e7654fa30f52b7ef788f31f21
Last affected
36e53d8ea23fa042071252877a74e824a6d314aa
Database specific 
{
    "cpe": [
        "cpe:2.3:a:jenkins:script_security:1.0:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.1:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.2:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.3:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.4:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.5:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.6:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.7:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.8:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.9:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.10:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.11:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.12:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.13:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.14:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.15:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.16:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.17:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:script_security:1.18:*:*:*:*:jenkins:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "1.0"
        },
        {
            "last_affected": "1.0"
        },
        {
            "introduced": "1.1"
        },
        {
            "last_affected": "1.1"
        },
        {
            "introduced": "1.2"
        },
        {
            "last_affected": "1.2"
        },
        {
            "introduced": "1.3"
        },
        {
            "last_affected": "1.3"
        },
        {
            "introduced": "1.4"
        },
        {
            "last_affected": "1.4"
        },
        {
            "introduced": "1.5"
        },
        {
            "last_affected": "1.5"
        },
        {
            "introduced": "1.6"
        },
        {
            "last_affected": "1.6"
        },
        {
            "introduced": "1.7"
        },
        {
            "last_affected": "1.7"
        },
        {
            "introduced": "1.8"
        },
        {
            "last_affected": "1.8"
        },
        {
            "introduced": "1.9"
        },
        {
            "last_affected": "1.9"
        },
        {
            "introduced": "1.10"
        },
        {
            "last_affected": "1.10"
        },
        {
            "introduced": "1.11"
        },
        {
            "last_affected": "1.11"
        },
        {
            "introduced": "1.12"
        },
        {
            "last_affected": "1.12"
        },
        {
            "introduced": "1.13"
        },
        {
            "last_affected": "1.13"
        },
        {
            "introduced": "1.14"
        },
        {
            "last_affected": "1.14"
        },
        {
            "introduced": "1.15"
        },
        {
            "last_affected": "1.15"
        },
        {
            "introduced": "1.16"
        },
        {
            "last_affected": "1.16"
        },
        {
            "introduced": "1.17"
        },
        {
            "last_affected": "1.17"
        },
        {
            "introduced": "1.18"
        },
        {
            "last_affected": "1.18"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*
1.0
1.1
1.10
1.11
1.12
1.13
1.14
1.15
1.16
1.17
1.18
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9
script-security-1.*
script-security-1.0
script-security-1.1
script-security-1.10
script-security-1.11
script-security-1.12
script-security-1.13
script-security-1.14
script-security-1.15
script-security-1.16
script-security-1.17
script-security-1.18
script-security-1.2
script-security-1.3
script-security-1.4
script-security-1.5
script-security-1.6
script-security-1.7
script-security-1.8
script-security-1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-3102.json"