CVE-2019-1003030

9.9

CVSS
Critical

PUBLISHED

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml,...

Exploited in the wild Remote Low complexity No user interaction

Vendor: Jenkins project
Product: Jenkins Pipeline: Groovy Plugin
Published: Mar 08, 2019
EPSS: —

Description

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

java cisa

CVSS scores

CVSS v3.1 9.9 Critical

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0 6.5

AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitation status

Exploited in the wild

Recorded 2022-03-25 00:00:00 UTC · Source

SSVC decision points

Exploitation: active
Automatable: No
Technical impact: total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
CISA	Mar 25, 2022

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

overgrowncarrot1/CVE-2019-1003030

github · Created 2025-03-01 03:07:08 UTC · 1 stars

Vulnerability detail