CVE-2019-1003029

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-1003029
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

9.9 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/107476 Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/107476 Broken Link Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2019:0739 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0739 Third Party Advisory
https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29 Third Party Advisory
https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*

Configuration 2 (hide)

cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
History

27 Jan 2025, 21:54

Type Values Removed Values Added
References (MISC) http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html - Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html - Third Party Advisory, VDB Entry
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:0739 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:0739 - Third Party Advisory
References (BID) http://www.securityfocus.com/bid/107476 - Broken Link, Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/107476 - Broken Link, Third Party Advisory, VDB Entry
References (MISC) https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29 - Third Party Advisory () https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29 - Third Party Advisory

02 Jul 2024, 16:58

Type Values Removed Values Added
References (MISC) https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29 - (MISC) https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29 - Third Party Advisory
References (BID) http://www.securityfocus.com/bid/107476 - Broken Link (BID) http://www.securityfocus.com/bid/107476 - Broken Link, Third Party Advisory, VDB Entry

25 Oct 2023, 18:16

Type Values Removed Values Added
References
  • {'url': 'https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(1)', 'name': 'https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(1)', 'tags': ['Vendor Advisory'], 'refsource': 'CONFIRM'}
  • (MISC) https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29 -
Information

Published : 2019-03-08 21:29

Updated : 2025-02-20 18:05

NVD link : CVE-2019-1003029

Mitre link : CVE-2019-1003029

JSON object : View

Products Affected

jenkins

  • script_security

redhat

  • openshift_container_platform
CWE
NVD-CWE-noinfo