CVE-2019-1003029

mediumPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEPSS 0.744 · 99. PerzentilExploit · waffenfähigEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 1 exploit · waffenfähig

Likely / severe?

74.4% (99th) EPSS

CVSS 6.5 · medium

Is it mine?

7 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

hinzugefügt 2022-04-25beheben bis 2022-05-16

erforderliche Maßnahme Apply updates per vendor instructions.

EPSS · bewertet 2026-10-26

Jenkins Script Security Plugin Sandbox Bypass Vulnerability

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenjenkins-2-plugins-0:3.11.1552336312-1.el7.noarch as a component of Red Hat OpenShift Container Platform 3.11redhat_csaf
See the following documentation, which will be updated shortly for release 3.11.98, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2019:0739
Behobenjenkins-2-plugins-0:3.11.1552336312-1.el7.src as a component of Red Hat OpenShift Container Platform 3.11redhat_csaf
See the following documentation, which will be updated shortly for release 3.11.98, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
https://access.redhat.com/errata/RHSA-2019:0739

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.9

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 6.5–9.9

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 8 · Auswirkung 6.4

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.1 · Auswirkung 6

v3.08.8highCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HsecondaryAusnutzbarkeit 3.1 · Auswirkung 6

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:Hsecondary · OSV

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.19.9criticalAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-693USCWE-96USCWE-96US

Exploits (1)

Öffentlicher Proof-of-Concept- und Exploit-Code.

exploit/multi/http/jenkins_metaprogrammingJenkins ACL Bypass and Metaprogramming RCEwaffenfähig · metasploit

betroffene Produkte (7)

Betroffene Produkte und Versionsbereiche.

Jenkins Project Jenkins Script Security Plugin≤ 1.53 and earlierenisa_euvdEU
CD Foundation Jenkins Script Security1.0 → 1.9fstec_bduRU
jenkins script security≤ 1.53nvdUScpe:2.3:a:jenkins:script_security:*:*:*:*:*:*:*:*
redhat openshift container platform= 3.11nvdUScpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
Maven org.jenkins-ci.plugins:script-security< 1.54osvUSpkg:maven/org.jenkins-ci.plugins/script-security
jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch as a component of Red Hat OpenShift Container Platform 3.11alle Versionenfixedredhat_csafUS
jenkins-2-plugins-0:3.11.1552336312-1.el7.src as a component of Red Hat OpenShift Container Platform 3.11alle Versionenfixedredhat_csafUS

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2019:0739Red Hat Security Advisory: Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update2019-04-10csaf · redhat_csafUS
An update for jenkins-2-plugins is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
GHSA-xvxq-hq48-xphmSandbox bypass in Script Security Plugin2022-05-13ghsa · osvUS
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu nvd osv redhat_csaf NVD CVE.org MITRE

veröffentlicht 2019-03-08geändert 2026-06-17

Referenzen (18)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan