CVE-2020-2135: 
Java vulnerability analysis and mitigation

CVE-2020-2135 is a high-severity vulnerability discovered in Jenkins Script Security Plugin versions 1.70 and earlier, disclosed on March 9, 2020. The vulnerability affects the sandbox protection mechanism of the plugin, specifically related to method calls on objects that implement GroovyInterceptable (Jenkins Advisory, OSS Security).

The vulnerability allows sandbox protection to be circumvented through crafted method calls on objects that implement GroovyInterceptable. The issue was discovered alongside another sandbox bypass vulnerability (CVE-2020-2134) related to constructor calls. The vulnerability has a high severity rating according to CVSS scoring system (Jenkins Advisory).

This vulnerability allows attackers who can specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins controller JVM, potentially compromising the entire Jenkins instance (Jenkins Advisory).

The vulnerability was fixed in Script Security Plugin version 1.71. The fix includes intercepting method calls on objects that implement GroovyInterceptable as calls to GroovyObject#invokeMethod(String, Object), which is on the list of dangerous signatures and should not be approved for use in the sandbox (Jenkins Advisory).