CVE-2019-1003030

high-risk
Published 2019-03-08

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Do I need to act?

!
92.9% chance of exploitation in next 30 days
EPSS score — higher than 7% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
1 public exploit available
48904
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.9/10 Critical
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Redhat Jenkins

References (9)

Exploit http://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html
Broken Link http://www.securityfocus.com/bid/107476
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:0739
Third Party Advisory https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%282%29
Exploit http://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html
Broken Link http://www.securityfocus.com/bid/107476
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:0739
Third Party Advisory https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%282%29
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-...
67
/ 100
high-risk
Severity 33/34 · Critical
Exploitability 27/34 · High
Exposure 7/34 · Low