{"id":"CVE-2020-2110","aliases":["EUVD-2022-5037","GHSA-qvmf-36h5-3f5v","RHSA-2020:2478","RHSA-2020:2737","RHSA-2020:3616"],"status":"published","title":"Improper Input Validation in Jenkins Script Security Plugin","description":"Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01257,"percentile":0.69924,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2020-02-12T14:35:40Z","modified":"2026-10-24T10:30:25Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","fixed_in":["1.70"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.69"},{"fixed":"1.70"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.70"}]}],"versions":["1.0","1.0-beta-1","1.0-beta-2","1.0-beta-3","1.0-beta-4","1.0-beta-5","1.0-beta-6","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18","1.18.1","1.19","1.2","1.20","1.21","1.22","1.23","1.24","1.25","1.26","1.27","1.28","1.29","1.29.1","1.3","1.30","1.31","1.33","1.34","1.35","1.36","1.37","1.38","1.39","1.4","1.40","1.41","1.42","1.43","1.44","1.44.1","1.45","1.46","1.46.1","1.47","1.48","1.49","1.5","1.50","1.51","1.52","1.53","1.54","1.54.1","1.54.2","1.54.3","1.54.4","1.55","1.56","1.57","1.57.1","1.57.2","1.57.3","1.57.4","1.57.5","1.57.6","1.58","1.59","1.6","1.60","1.60.1","1.61","1.62","1.63","1.63.1","1.64","1.65","1.66","1.66.1","1.66.2","1.66.3","1.66.4","1.66.5","1.67","1.68","1.69","1.7","1.8","1.9"]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.1591354111-1.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.1592817009-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.1597915133-1.el7"}]}],"bundled":7}],"products":[{"vendor":"jenkins","product":"script_security"},{"vendor":"jenkins project","product":"jenkins script security plugin"}],"references":[{"url":"https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1713","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2020/02/12/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2110","tags":["advisory"]},{"url":"https://github.com/jenkinsci/script-security-plugin/commit/1a09bdcf789b87c4e158aacebd40937c64398de3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qvmf-36h5-3f5v"},{"url":"https://access.redhat.com/errata/RHSA-2020:2478","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819078","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819105","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819652","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819704","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2478.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10392","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10392","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1534","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16538","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16538","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16538","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1658","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2109","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2109","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2109","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1710","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2110","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2110","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2111","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2111","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2111","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1725","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2134","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2134","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2134","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1754","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2135","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2135","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2135","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2136","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1723","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2737","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2737.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3616","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3616.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-2110","description":"Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.","status":"published","published":"2020-02-12T14:35:40Z","modified":"2024-08-04T07:01:39.727Z","updated_at":"2026-11-02T14:35:51.206854Z"}],"euvd":[{"id":"EUVD-2022-5037","description":"Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.","status":"published","published":"2020-02-12T14:35:40Z","modified":"2024-08-04T07:01:39Z","updated_at":"2026-11-03T03:08:10.95725Z"}],"ghsa":[{"id":"GHSA-qvmf-36h5-3f5v","title":"Improper Input Validation in Jenkins Script Security Plugin","description":"Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.","status":"published","published":"2022-05-24T17:08:45Z","modified":"2023-12-13T12:12:53Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:25.311671Z"}],"nvd":[{"id":"CVE-2020-2110","description":"Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.","status":"published","published":"2020-02-12T15:15:12.507Z","modified":"2026-06-17T03:11:46.607Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:05:53.837808Z"}],"osv":[{"id":"CVE-2020-2110","description":"Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.","status":"published","published":"2020-02-12T15:15:12.507Z","modified":"2026-10-24T10:30:25.935193274Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:15.212689Z"},{"id":"GHSA-qvmf-36h5-3f5v","title":"Improper Input Validation in Jenkins Script Security Plugin","description":"Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.","status":"published","published":"2022-05-24T17:08:45Z","modified":"2024-02-16T08:23:25.460499Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"RHSA-2020:2478","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins-2-plugins security update","status":"published","published":"2024-09-16T04:30:15Z","modified":"2026-06-27T10:10:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2737","title":"Red Hat Security Advisory: OpenShift Container Platform 4.4.z jenkins-2-plugins security update","status":"published","published":"2024-09-16T04:30:23Z","modified":"2025-11-22T12:03:53Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3616","title":"Red Hat Security Advisory: OpenShift Container Platform 4.3.35 jenkins-2-plugins security update","status":"published","published":"2024-09-16T04:30:31Z","modified":"2025-11-22T12:07:15Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"}]}}