CVE-2020-2279: 
Java vulnerability analysis and mitigation

CVE-2020-2279 is a sandbox bypass vulnerability discovered in Jenkins Script Security Plugin versions 1.74 and earlier. The vulnerability was disclosed on September 23, 2020, affecting the Script Security Plugin's sandbox feature, which is designed to allow low-privileged users to define and execute generally safe scripts, including Pipelines (Jenkins Advisory).

The vulnerability exists in the Script Security Plugin's sandbox implementation where calls from outside a sandboxed script to code defined inside a sandboxed script were always allowed. This security flaw occurs when sandboxed scripts communicate their results through script return values and similar mechanisms, potentially allowing code defined inside a sandboxed script to be called without sandbox protection (Jenkins Advisory, OSS Security). The vulnerability is rated as High severity according to CVSS scoring system.

The vulnerability enables attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection mechanism. This bypass allows the execution of arbitrary code in the context of the Jenkins controller JVM (Jenkins Advisory).

The vulnerability is exploitable by attackers who have permissions to define and run sandboxed scripts in Jenkins. The exploitation occurs when code defined inside a sandboxed script is called from outside the sandbox context, effectively bypassing the security controls (Jenkins Advisory).

The vulnerability was fixed in Script Security Plugin version 1.75, which prevents code defined inside a sandbox from being invoked outside a sandboxed script. For compatibility, users should also upgrade related plugins: Email Extension Plugin to version 2.77 or newer, Warnings Next Generation Plugin to version 8.4.3 or newer, and Warnings Plugin to version 5.0.2 or newer. In cases where script return values or bindings include sandbox-defined code, values should be converted to known safe types like String inside the sandboxed script (Jenkins Advisory).