Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-1003000

CWE-96CWE-69320 documents11 sources
Severity
8.8HIGH
EPSS
94.4%
top < 0.01%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Jenkins Script SecurityJenkins Project Script Security PluginRedhat Openshift Container Platform
Timeline
PublishedJan 22
Latest updateMar 3

Description

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5jenkins_project/script_security_plugin1.49 and earlier

Also affects: Openshift Container Platform 3.11

🔴Vulnerability Details

4
OSV
Protection Mechanism Failure in Jenkins Script Security Plugin↗2022-05-13
▶
GHSA
Protection Mechanism Failure in Jenkins Script Security Plugin↗2022-05-13
▶
CVEList
CVE-2019-1003000: A sandbox bypass vulnerability exists in Script Security Plugin 1↗2019-01-22
▶
VulnCheck
Script Security Plugin Sandboxed Script Execution Vulnerability↗2019
▶

💥Exploits & PoCs

4
Exploit-DB
Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)↗2019-03-19
▶
Exploit-DB
Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution↗2019-02-25
▶
Exploit-DB
Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)↗2019-02-19
▶
Nuclei
Jenkins Script Security Plugin <=1.49 - Sandbox Bypass
▶

🔍Detection Rules

4
Suricata
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M3↗2025-03-03
▶
Suricata
ET WEB_SPECIFIC_APPS Jenkins RCE CVE-2019-1003000↗2019-05-10
▶
Suricata
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M1↗2019-05-10
▶
Suricata
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M2↗2019-05-10
▶

📋Vendor Advisories

3
Red Hat
jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)↗2019-01-29
▶
Red Hat
jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin↗2019-01-08
▶
Jenkins
Jenkins Security Advisory 2019-01-08↗2019-01-08
▶

💬Community

4
Bugzilla
CVE-2019-1003005 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)↗2019-01-29
▶
Bugzilla
CVE-2019-1003000 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin↗2019-01-18
▶
Bugzilla
CVE-2019-1003000 groovy-sandbox: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin [fedora-all]↗2019-01-18
▶
Bugzilla
CVE-2019-1003000 jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin [fedora-all]↗2019-01-18
▶
CVE-2019-1003000 (HIGH CVSS 8.8) | A sandbox bypass vulnerability exis | cvebase.io