Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/57875?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57875?format=api", "vulnerability_id": "VCID-24jy-j38r-13bv", "summary": "Incorrect Authorization in Jenkins Script Security Plugin\nA sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.", "aliases": [ { "alias": "CVE-2019-16538" }, { "alias": "GHSA-62pm-mgrh-7p69" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/84028?format=api", "purl": "pkg:maven/org.jenkins-ci.plugins/script-security@1.68", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.plugins/script-security@1.68" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/143627?format=api", "purl": "pkg:maven/org.jenkins-ci.plugins/script-security@1.67", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-24jy-j38r-13bv" }, { "vulnerability": "VCID-3f3m-rqye-dbhe" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.plugins/script-security@1.67" }, { "url": "http://public2.vulnerablecode.io/api/packages/103984?format=api", "purl": "pkg:rpm/redhat/jenkins-2-plugins@3.11.1591354111-1?arch=el7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-24jy-j38r-13bv" }, { "vulnerability": "VCID-2nkx-bafa-gqde" }, { "vulnerability": "VCID-5h17-3b63-s7gr" }, { "vulnerability": "VCID-6gvv-5195-cbhh" }, { "vulnerability": "VCID-qqe6-hpzt-wkhn" }, { "vulnerability": "VCID-rus3-fvn9-53h9" }, { "vulnerability": "VCID-xtbk-gqyx-8fep" }, { "vulnerability": "VCID-yn97-nd7r-b7hj" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/jenkins-2-plugins@3.11.1591354111-1%3Farch=el7" }, { "url": "http://public2.vulnerablecode.io/api/packages/103985?format=api", "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.3.1597915133-1?arch=el7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-24jy-j38r-13bv" }, { "vulnerability": "VCID-2nkx-bafa-gqde" }, { "vulnerability": "VCID-5h17-3b63-s7gr" }, { "vulnerability": "VCID-6gvv-5195-cbhh" }, { "vulnerability": "VCID-qqe6-hpzt-wkhn" }, { "vulnerability": "VCID-xtbk-gqyx-8fep" }, { "vulnerability": "VCID-yn97-nd7r-b7hj" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/jenkins-2-plugins@4.3.1597915133-1%3Farch=el7" }, { "url": "http://public2.vulnerablecode.io/api/packages/103983?format=api", "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.4.1592817009-1?arch=el7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-24jy-j38r-13bv" }, { "vulnerability": "VCID-2nkx-bafa-gqde" }, { "vulnerability": "VCID-5h17-3b63-s7gr" }, { "vulnerability": "VCID-6gvv-5195-cbhh" }, { "vulnerability": "VCID-qqe6-hpzt-wkhn" }, { "vulnerability": "VCID-xtbk-gqyx-8fep" }, { "vulnerability": "VCID-yn97-nd7r-b7hj" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/jenkins-2-plugins@4.4.1592817009-1%3Farch=el7" } ], "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-16538.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-16538.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-16538", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00176", "scoring_system": "epss", "scoring_elements": "0.39119", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00176", "scoring_system": "epss", "scoring_elements": "0.38939", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00176", "scoring_system": "epss", "scoring_elements": "0.39125", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00176", "scoring_system": "epss", "scoring_elements": "0.39147", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00176", "scoring_system": "epss", "scoring_elements": "0.39067", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00176", "scoring_system": "epss", "scoring_elements": "0.39122", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00176", "scoring_system": "epss", "scoring_elements": "0.39138", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00176", "scoring_system": "epss", "scoring_elements": "0.3915", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00176", "scoring_system": "epss", "scoring_elements": "0.39113", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00176", "scoring_system": "epss", "scoring_elements": "0.39094", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00176", "scoring_system": "epss", "scoring_elements": "0.39149", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-16538" }, { "reference_url": "https://github.com/jenkinsci/script-security-plugin/commit/0e7da14171ed1d03ff72f6910392e630b40a8590", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/script-security-plugin/commit/0e7da14171ed1d03ff72f6910392e630b40a8590" }, { "reference_url": "https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1658", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1658" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16538", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:L/Au:S/C:P/I:P/A:P" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16538" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2019/11/21/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2019/11/21/1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819652", "reference_id": "1819652", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819652" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*", "reference_id": "cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*" }, { "reference_url": "https://github.com/advisories/GHSA-62pm-mgrh-7p69", "reference_id": "GHSA-62pm-mgrh-7p69", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-62pm-mgrh-7p69" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2478", "reference_id": "RHSA-2020:2478", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2478" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2737", "reference_id": "RHSA-2020:2737", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2737" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:3616", "reference_id": "RHSA-2020:3616", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:3616" } ], "weaknesses": [ { "cwe_id": 863, "name": "Incorrect Authorization", "description": "The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions." }, { "cwe_id": 94, "name": "Improper Control of Generation of Code ('Code Injection')", "description": "The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." } ], "exploits": [], "severity_range_score": "6.5 - 8.9", "exploitability": "0.5", "weighted_severity": "8.0", "risk_score": 4.0, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-24jy-j38r-13bv" }