CVE-2019-1003029
Last modified
CVE-2019-1003029 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.. CISA has confirmed active exploitation in the wild. EPSS estimates a 74.25% chance of exploitation in the next 30 days.
Description
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
Metrics
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Script Security | <= 1.53 |
| Redhat | Openshift Container Platform | 3.11 |
References
- https://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
- https://www.securityfocus.com/bid/107476Broken Link, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:0739Third Party Advisory
- https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29Third Party Advisory
- https://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
- https://www.securityfocus.com/bid/107476Broken Link, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:0739Third Party Advisory
- https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003029US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2019-1003029?
How severe is CVE-2019-1003029?
How do I fix CVE-2019-1003029?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-1003023A cross-site scripting vulnerability exists in Jenkins Warni…
- CVE-2019-1003024A sandbox bypass vulnerability exists in Jenkins Script Secu…8.8
- CVE-2019-1003025A exposure of sensitive information vulnerability exists in …8.8
- CVE-2019-1003026A server-side request forgery vulnerability exists in Jenkin…
- CVE-2019-1003027A server-side request forgery vulnerability exists in Jenkin…
- CVE-2019-1003028A server-side request forgery vulnerability exists in Jenkin…
- CVE-2019-1003030A sandbox bypass vulnerability exists in Jenkins Pipeline: G…9.9
- CVE-2019-1003031A sandbox bypass vulnerability exists in Jenkins Matrix Proj…9.9
- CVE-2019-1003032A sandbox bypass vulnerability exists in Jenkins Email Exten…9.9
- CVE-2019-1003033A sandbox bypass vulnerability exists in Jenkins Groovy Plug…8.8
- CVE-2019-1003034A sandbox bypass vulnerability exists in Jenkins Job DSL Plu…9.9
- CVE-2019-1003035An information exposure vulnerability exists in Jenkins Azur…4.3
Are you affected by CVE-2019-1003029?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST