CVE-2019-1003030
Last modified
CVE-2019-1003030 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.. CISA has confirmed active exploitation in the wild. EPSS estimates a 75.96% chance of exploitation in the next 30 days.
Description
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
Metrics
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Pipeline\ | <= 2.63 |
| Redhat | Openshift Container Platform | 3.11 |
References
- https://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.htmlExploit, Third Party Advisory, VDB Entry
- https://www.securityfocus.com/bid/107476Broken Link, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:0739Third Party Advisory
- https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%282%29Third Party Advisory
- https://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.htmlExploit, Third Party Advisory, VDB Entry
- https://www.securityfocus.com/bid/107476Broken Link, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:0739Third Party Advisory
- https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%282%29Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003030US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2019-1003030?
How severe is CVE-2019-1003030?
How do I fix CVE-2019-1003030?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-1003024A sandbox bypass vulnerability exists in Jenkins Script Secu…8.8
- CVE-2019-1003025A exposure of sensitive information vulnerability exists in …8.8
- CVE-2019-1003026A server-side request forgery vulnerability exists in Jenkin…
- CVE-2019-1003027A server-side request forgery vulnerability exists in Jenkin…
- CVE-2019-1003028A server-side request forgery vulnerability exists in Jenkin…
- CVE-2019-1003029A sandbox bypass vulnerability exists in Jenkins Script Secu…9.9
- CVE-2019-1003031A sandbox bypass vulnerability exists in Jenkins Matrix Proj…9.9
- CVE-2019-1003032A sandbox bypass vulnerability exists in Jenkins Email Exten…9.9
- CVE-2019-1003033A sandbox bypass vulnerability exists in Jenkins Groovy Plug…8.8
- CVE-2019-1003034A sandbox bypass vulnerability exists in Jenkins Job DSL Plu…9.9
- CVE-2019-1003035An information exposure vulnerability exists in Jenkins Azur…4.3
- CVE-2019-1003036A data modification vulnerability exists in Jenkins Azure VM…4.3
Are you affected by CVE-2019-1003030?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST