CVE-2023-25765

CRITICAL Year: 2023
CVSS v3 Score
9.9
Critical
Weakness Type
CWE-693
View all →

Vulnerability Description

In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Related Vulnerabilities

CVE-2019-1003030

CRITICAL
CVSS:9.9(Critical)

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to...

CWE-6932019

CVE-2019-10328

CRITICAL
CVSS:9.9(Critical)

Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.

CWE-6932019

CVE-2021-32835

CRITICAL
CVSS:9.9(Critical)

Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a sandbox escape vulnerability may lead to post-authentication Remote Code exec...

CWE-6932021

CVE-2013-2465

CRITICAL
CVSS:9.8(Critical)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remot...

CWE-6932013

CVE-2017-3197

CRITICAL
CVSS:9.8(Critical)

GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 (version F6) and GB-BXi7-5775 (version F2) platforms does not securely implement BIOSWE, BLE, SMM_BWP, and PRx features. As a result, the BIOS is not ...

CWE-6932017

CVE-2017-8864

CRITICAL
CVSS:9.8(Critical)

Client-side enforcement using JavaScript of server-side security options on the Cohu 3960HD allows an attacker to manipulate options sent to the camera and cause malfunction or code execution, as demo...

CWE-6932017