CVE-2017-1000107

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10001087.5The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. Thi CVE-2017-10001096.1The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scrip CVE-2017-10001104.3Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches co CVE-2017-10001117.8Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a s CVE-2017-10001127.0Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() c CVE-2017-10001135.5The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file CVE-2017-10001143.1The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypte CVE-2017-10001157.5Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the reposito CVE-2017-10001169.8Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.CVE-2017-10001178.8A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any prog CVE-2017-10001187.5Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service CVE-2017-10001197.2October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other a