PT-2019-2300 · Jenkins · Jenkins Pipeline: Groovy Plugin+1

Georgy Noseevich

+1

·

Publicado

2019-03-08

·

Atualizado

2025-10-24

·

CVE-2019-1003030

CVSS v3.1

9.9

Crítica

VetorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Groovy Plugin versions 2.63 and earlier
Description A sandbox bypass issue exists that allows attackers who can control pipeline scripts to execute arbitrary code on the Jenkins master JVM. The vulnerability is related to errors in handling input data during code syntax analysis in components such as pom.xml and CpsGroovyShell.java. This could enable a remote attacker to bypass sandbox restrictions and execute arbitrary code.
Recommendations For Jenkins Pipeline: Groovy Plugin versions 2.63 and earlier, update to a version later than 2.63 to resolve the issue. As a temporary workaround, consider restricting access to the Jenkins master JVM to minimize the risk of exploitation.

Exploit

Correção

RCE

Protection Mechanism Failure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20CWE-693

Identificadores relacionados

BDU:2019-02071
CVE-2019-1003030
GHSA-R6MC-MRVR-23CR
RHSA-2019:0739

Produtos afetados

Jenkins
Jenkins Pipeline: Groovy Plugin