CVE-2019-1003024

CWE-968 documents7 sources

Severity

8.8HIGH

EPSS

0.3%

top 46.48%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Jenkins Script Security Jenkins Project Jenkins Script Security Plugin Redhat Openshift Container Platform

Timeline

PublishedFeb 20

Latest updateMay 13

Description

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶Mavenorg.jenkins-ci.plugins:script-security< 1.53

▶CVEListV5jenkins_project/jenkins_script_security_plugin1.52 and earlier

▶NVDjenkins/script_security1.52

Also affects: Openshift Container Platform 3.11

🔴Vulnerability Details

GHSA

Jenkins Script Security Plugin sandbox bypass vulnerability↗2022-05-13

▶

OSV

Jenkins Script Security Plugin sandbox bypass vulnerability↗2022-05-13

▶

CVEList

CVE-2019-1003024: A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1↗2019-02-20

▶

📋Vendor Advisories

Red Hat

jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1320)↗2019-02-19

▶

Jenkins

Jenkins Security Advisory 2019-02-19↗2019-02-19

▶

💬Community

Bugzilla

CVE-2019-1003024 jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1320) [fedora-all]↗2019-03-01

▶

Bugzilla

CVE-2019-1003024 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1320)↗2019-03-01

▶