CVE-2022-43402
Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
- Record
CVE-2022-43402- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
CVE List No score
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
- Record
CVE-2022-43402- Updated
- 2026-11-02
EUVDEUVD-2022-7132 No score
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
- Record
EUVD-2022-7132- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mqc2-w9r8-mmxm
Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Pipeline: Groovy Plugin 2803.v1a_f77ffcc773 intercepts Groovy casts performed implicitly by the Groovy language runtime
- Record
GHSA-mqc2-w9r8-mmxm- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-693
- Updated
- 2026-11-02
OSV
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
- Record
CVE-2022-43402- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-mqc2-w9r8-mmxm
Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Pipeline: Groovy Plugin 2803.v1a_f77ffcc773 intercepts Groovy casts performed implicitly by the Groovy language runtime
- Record
GHSA-mqc2-w9r8-mmxm- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-693
- Updated
- 2026-11-02
Show 4 moreShow less
OSVRHSA-2023:0560
Red Hat Security Advisory: OpenShift Container Platform 4.10.51 security update
- Record
RHSA-2023:0560- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:0777
Red Hat Security Advisory: OpenShift Container Platform 4.9.56 security update
- Record
RHSA-2023:0777- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:1064
Red Hat Security Advisory: OpenShift Developer Tools and Services for OCP 4.12 security update
- Record
RHSA-2023:1064- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:3198
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2023:3198- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins.workflow:workflow-cpsMaven |
before 2803.v1a | 2803.v1a |
org.jenkins-ci.plugins.workflow:workflow-cpsMaven |
before 2803.v1a_f77ffcc773, plus listed versions 0.1-beta-10.1-beta-20.1-beta-30.1-beta-40.1-beta-5 Show 45 moreShow less0.1-beta-60.1-beta-70.1-beta-81.01.0-beta-11.11.101.10-beta-11.10.11.111.11-beta-11.11-beta-21.11-beta-31.11-beta-41.121.12-beta-11.12-beta-21.12-beta-31.131.141.14-beta-11.14.11.14.1-beta-11.14.21.151.15-beta-11.21.31.41.4.11.4.21.4.31.4.3-beta-11.51.61.6-alpha-11.71.7-alpha-11.81.91.9-beta-12.02.12.102.11 |
2803.v1a_f77ffcc773 |
jenkins-2-pluginsRed Hat:openshift:4.10::el8 From an advisory covering 23 CVEs |
before 0:4.10.1675144701-1.el8 | 0:4.10.1675144701-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.9::el8 From an advisory covering 26 CVEs |
before 0:4.9.1675668922-1.el8 | 0:4.9.1675668922-1.el8 |
jenkinsRed Hat:openshift:4.9::el8 From an advisory covering 26 CVEs |
before 0:2.361.1.1675668150-1.el8 | 0:2.361.1.1675668150-1.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.12::el8 From an advisory covering 15 CVEs |
before 0:4.12.1675702407-1.el8 | 0:4.12.1675702407-1.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.11::el8 From an advisory covering 22 CVEs |
before 0:4.11.1683009941-1.el8 | 0:4.11.1683009941-1.el8 |
jenkinsRed Hat:ocp_tools:4.11::el8 From an advisory covering 22 CVEs |
before 0:2.387.1.1683009763-3.el8 | 0:2.387.1.1683009763-3.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-43402 is a critical vulnerability (CVSS 9.9) in Jenkins Project Pipeline: Groovy Plugin, published October 19, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.48%, the 74th percentile. Fixed in org.jenkins-ci.plugins.workflow:workflow-cps 2803.v1a.
References
jenkins.io/security/advisory/2022-10-19
openwall.com/lists/oss-security/2022/10/19/3
nvd.nist.gov/vuln/detail/CVE-2022-43402
github.com/advisories/GHSA-mqc2-w9r8-mmxm
access.redhat.com/errata/RHSA-2023:0560
Show 176 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1856376
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0560.json
cve.org/CVERecord?id=CVE-2020-7692
bitbucket.org/snakeyaml/snakeyaml/issues/525
mail-archive.com/[email protected]/msg39312.html
docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html
maven.apache.org/docs/3.8.1/release-notes.html
blogs.apache.org/security/entry/cve-2022-42889
lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
seclists.org/oss-sec/2022/q4/22
Left out here: 147 versions. The JSON record has them.