Pipelines are subject to script security: Either the entire Pipeline needs to be approved, or it runs in a sandbox, with only whitelisted methods etc. allowed to be called. Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles. External References: https://jenkins.io/security/advisory/2017-07-10/
Acknowledgments: Name: the Jenkins project Upstream: Simon St John, Green
Statement: This issue affects the versions of jenkins-plugin-workflow-cps as shipped with Red Hat OpenShift Enterprise 3. However, this flaw is of low impact under the supported scenarios in OpenShift Enterprise 3. A future update may address this issue.