HackerFeeds
All CVEs

CVE-2019-1003029

CRITICAL9.9
CISA KEV

Published 2019-03-08 · Updated 2026-06-17 · Source jenkinsci-cert@googlegroups.com

Summary

CVE-2019-1003029 is a critical-severity (CVSS 9.9) vulnerability in Jenkins Script Security Plugin. CISA added it to the Known Exploited Vulnerabilities catalog on April 25, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 16, 2022. CISA does not currently list it as used in ransomware campaigns. Jenkins has 6 vulnerabilities in the KEV catalog, 1 of them linked to ransomware.

All 6 known-exploited Jenkins vulnerabilities →

Description

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA Known-Exploited Vulnerability

Product: Jenkins — Script Security Plugin

Name: Jenkins Script Security Plugin Sandbox Bypass Vulnerability

Date added: 2022-04-25 · Due: 2022-05-16

Required action: Apply updates per vendor instructions.

References

View on NVD