CVE-2020-2279

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide crafted return values or script binding content that can result in arbitrary code execution on the Jenkins controller JVM.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Sep 23, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-227905.4Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injecting arbitrary web scCVE-2020-22808.8A cross-site request forgery (CSRF) vulnerability in Jenkins Warnings Plugin 5.0.1 and earlier allows attackers to execute arbitrary code.CVE-2020-228079.8An issue was dicovered in vtiger crm 7.2. Union sql injection in the calendar exportdata feature.CVE-2020-228086.1An issue was found in yii2_fecshop 2.x. There is a reflected XSS vulnerability in the check cart page.CVE-2020-228097.8In Windscribe v1.83 Build 20, 'WindscribeService' has an Unquoted Service Path that facilitates privilege escalation.CVE-2020-22815.4A cross-site request forgery (CSRF) vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreservCVE-2020-228189.8MKCMS V6.2 has SQL injection via /ucenter/reg.php name parameter.CVE-2020-228199.8MKCMS V6.2 has SQL injection via the /ucenter/active.php verify parameter.CVE-2020-22824.3Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read CVE-2020-228209.8MKCMS V6.2 has SQL injection via the /ucenter/repass.php name parameter.CVE-2020-22835.4Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulneCVE-2020-228396.1Reflected cross-site scripting vulnerability (XSS) in the evoadm.php file in b2evolution cms version 6.11.6-stable allows remote attackers t
CVE-2020-2279: Critical severity, CVSS 9.9 | Vulnix