CVE-2023-24422
Sandbox bypass in Jenkins Script Security Plugin
8.8 HighPublic exploitFix available
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
0.59%Down 2.0 points since Jan 25, 2023
What each source reports
NVD Score used
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
- Record
CVE-2023-24422- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
- Record
CVE-2023-24422- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2023-0375
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
- Record
EUVD-2023-0375- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-76qj-9gwh-pvv3
Sandbox bypass in Jenkins Script Security Plugin
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
- Record
GHSA-76qj-9gwh-pvv3- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
- Record
CVE-2023-24422- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-76qj-9gwh-pvv3
Sandbox bypass in Jenkins Script Security Plugin
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
- Record
GHSA-76qj-9gwh-pvv3- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
Show 13 moreShow less
OSVRHSA-2023:1655
Red Hat Security Advisory: OpenShift Container Platform 4.10.56 security update
- Record
RHSA-2023:1655- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:3195
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2023:3195- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:3198
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2023:3198- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:3299
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2023:3299- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:3610
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2023:3610- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:6171
Red Hat Security Advisory: Red Hat Product OCP Tools 4.11 Openshift Jenkins security update
- Record
RHSA-2023:6171- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:6172
Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update
- Record
RHSA-2023:6172- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:6179
Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update
- Record
RHSA-2023:6179- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:7288
Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 Openshift Jenkins security update
- Record
RHSA-2023:7288- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:0775
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2024:0775- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:0776
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2024:0776- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:0777
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2024:0777- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:0778
Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update
- Record
RHSA-2024:0778- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:script-securityMaven |
before 1229.v4880b | 1229.v4880b |
org.jenkins-ci.plugins:script-securityMaven |
before 1229.v4880b, plus listed versions 1.01.0-beta-11.0-beta-21.0-beta-31.0-beta-4 Show 45 moreShow less1.0-beta-51.0-beta-61.11.101.111.121.131.141.151.161.171.181.18.11.191.21.201.211.221.231.241.251.261.271.281.291.29.11.31.301.311.331.341.351.361.371.381.391.41.401.411.421.431.441.44.11.451.46 |
1229.v4880b |
openshiftRed Hat:openshift:4.10::el7 From an advisory covering 10 CVEs |
before 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7 | 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7 |
openshift-hyperkubeRed Hat:openshift:4.10::el7 From an advisory covering 10 CVEs |
before 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7 | 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7 |
openshiftRed Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8 | 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8 |
openshift-hyperkubeRed Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8 | 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8 |
jenkinsRed Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:2.387.1.1680701869-1.el8 | 0:2.387.1.1680701869-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:4.10.1680703106-1.el8 | 0:4.10.1680703106-1.el8 |
haproxyRed Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:2.2.19-4.el8 | 0:2.2.19-4.el8 |
haproxy-debugsourceRed Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:2.2.19-4.el8 | 0:2.2.19-4.el8 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
haproxy22Red Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:2.2.19-4.el8 | 0:2.2.19-4.el8 |
haproxy22-debuginfoRed Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:2.2.19-4.el8 | 0:2.2.19-4.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.12::el8 From an advisory covering 6 CVEs |
before 0:4.12.1683009955-1.el8 | 0:4.12.1683009955-1.el8 |
jenkinsRed Hat:ocp_tools:4.12::el8 From an advisory covering 6 CVEs |
before 0:2.387.1.1683009767-3.el8 | 0:2.387.1.1683009767-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.11::el8 From an advisory covering 22 CVEs |
before 0:4.11.1683009941-1.el8 | 0:4.11.1683009941-1.el8 |
jenkinsRed Hat:ocp_tools:4.11::el8 From an advisory covering 22 CVEs |
before 0:2.387.1.1683009763-3.el8 | 0:2.387.1.1683009763-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.13::el8 From an advisory covering 16 CVEs |
before 0:4.13.1684911916-1.el8 | 0:4.13.1684911916-1.el8 |
jenkinsRed Hat:ocp_tools:4.13::el8 From an advisory covering 16 CVEs |
before 0:2.387.3.1684911776-3.el8 | 0:2.387.3.1684911776-3.el8 |
jenkinsRed Hat:ocp_tools:4.12::el8 From an advisory covering 13 CVEs |
before 0:2.401.1.1686649641-3.el8 | 0:2.401.1.1686649641-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.12::el8 From an advisory covering 13 CVEs |
before 0:4.12.1686649756-1.el8 | 0:4.12.1686649756-1.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.11::el8 From an advisory covering 9 CVEs |
before 0:4.11.1698299029-1.el8 | 0:4.11.1698299029-1.el8 |
jenkinsRed Hat:ocp_tools:4.11::el8 From an advisory covering 9 CVEs |
before 0:2.414.3.1698298955-3.el8 | 0:2.414.3.1698298955-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.12::el8 From an advisory covering 10 CVEs |
before 0:4.12.1698294000-1.el8 | 0:4.12.1698294000-1.el8 |
jenkinsRed Hat:ocp_tools:4.12::el8 From an advisory covering 10 CVEs |
before 0:2.414.3.1698293911-3.el8 | 0:2.414.3.1698293911-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.13::el8 From an advisory covering 8 CVEs |
before 0:4.13.1698292274-1.el8 | 0:4.13.1698292274-1.el8 |
jenkinsRed Hat:ocp_tools:4.13::el8 From an advisory covering 8 CVEs |
before 0:2.414.3.1698292201-3.el8 | 0:2.414.3.1698292201-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.14::el8 From an advisory covering 8 CVEs |
before 0:4.14.1699356715-1.el8 | 0:4.14.1699356715-1.el8 |
jenkinsRed Hat:ocp_tools:4.14::el8 From an advisory covering 8 CVEs |
before 0:2.414.3.1699356615-3.el8 | 0:2.414.3.1699356615-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.11::el8 From an advisory covering 11 CVEs |
before 0:4.11.1706516946-1.el8 | 0:4.11.1706516946-1.el8 |
jenkinsRed Hat:ocp_tools:4.11::el8 From an advisory covering 11 CVEs |
before 0:2.426.3.1706516929-3.el8 | 0:2.426.3.1706516929-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.13::el8 From an advisory covering 10 CVEs |
before 0:4.13.1706516346-1.el8 | 0:4.13.1706516346-1.el8 |
jenkinsRed Hat:ocp_tools:4.13::el8 From an advisory covering 10 CVEs |
before 0:2.426.3.1706516254-3.el8 | 0:2.426.3.1706516254-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.14::el8 From an advisory covering 17 CVEs |
before 0:4.14.1706516441-1.el8 | 0:4.14.1706516441-1.el8 |
jenkinsRed Hat:ocp_tools:4.14::el8 From an advisory covering 17 CVEs |
before 0:2.426.3.1706516352-3.el8 | 0:2.426.3.1706516352-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.12::el8 From an advisory covering 24 CVEs |
before 0:4.12.1706515741-1.el8 | 0:4.12.1706515741-1.el8 |
jenkinsRed Hat:ocp_tools:4.12::el8 From an advisory covering 24 CVEs |
before 0:2.426.3.1706515686-3.el8 | 0:2.426.3.1706515686-3.el8 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | shoucheng3/jenkinsci__script-security-plugin_CVE-2023-24422_1228.vd93135a_2fb_25 | 2025-08-19 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-24422 is a high vulnerability (CVSS 8.8) in Jenkins Script Security, published January 24, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in org.jenkins-ci.plugins:script-security 1229.v4880b.
References
jenkins.io/security/advisory/2023-01-24
nvd.nist.gov/vuln/detail/CVE-2023-24422
github.com/jenkinsci/script-security-plugin/commit/4880bbe905a6783d80150c8b881d0127430d4a73
access.redhat.com/errata/RHSA-2023:1655
Show 194 moreShow less
docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html
bugzilla.redhat.com/show_bug.cgi?id=2127804
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1655.json
cve.org/CVERecord?id=CVE-2022-3172
spring.io/security/cve-2022-31690
blogs.apache.org/security/entry/cve-2022-42889
lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
seclists.org/oss-sec/2022/q4/22
haproxy.com/blog/february-2023-header-parser-fixed
mail-archive.com/[email protected]/msg43229.html
maven.apache.org/docs/3.8.1/release-notes.html
bitbucket.org/snakeyaml/snakeyaml/issues/525
issues.redhat.com/browse/PITEAM-10
tanzu.vmware.com/security/cve-2022-22978
commons.apache.org/proper/commons-fileupload/security-reports.html
research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633
go.dev/issue/63417
pkg.go.dev/vuln/GO-2023-2102
cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products
openwall.com/lists/oss-security/2024/01/24/6
groups.google.com/g/golang-announce/c/nqrv9fbR0zE
rfc-editor.org/rfc/rfc9110
This page doesn't list everything
Left out here: 77 versions and 200 references. The JSON record has them.