Vulnerability Report

CVE-2017-1000107

Title: Jenkins Script Security

Other

Proof Of Concept

No public PoC currently indexed for CVE-2017-1000107.

CWE Category NVD-CWE-noinfo

Published Date Oct 05, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 8.8 CVSS v3.0

Exploit Probability (EPSS)

1.20%

Vulnerability Summary

CVE-2017-1000107: Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection.

Impacted Vendors

jenkins 1

Reference Links

https://jenkins.io/security/advisory/2017-08-07/ https://jenkins.io/security/advisory/2017-08-07/

CVSS v3.0

Source Entity [email protected]

Severity HIGH

8.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

6.5

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:S/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns