CVE-2017-1000107: Incorrect Permission Assignment for Critical Resource

October 5, 2017 (updated October 3, 2019)

Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection.

References

jenkins.io/security/advisory/2017-08-07/
nvd.nist.gov/vuln/detail/CVE-2017-1000107

Code Behaviors & Features

Detect and mitigate CVE-2017-1000107 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →