PT-2019-2300 · Jenkins · Jenkins Pipeline: Groovy Plugin+1

Georgy Noseevich + 1 · Published 2019-03-08 · Updated 2025-10-24 · CVE-2019-1003030

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Groovy Plugin versions 2.63 and earlier

Description A sandbox bypass issue exists that allows attackers who can control pipeline scripts to execute arbitrary code on the Jenkins master JVM. The vulnerability is related to errors in handling input data during code syntax analysis in components such as pom.xml and CpsGroovyShell.java. This could enable a remote attacker to bypass sandbox restrictions and execute arbitrary code.

Recommendations For Jenkins Pipeline: Groovy Plugin versions 2.63 and earlier, update to a version later than 2.63 to resolve the issue. As a temporary workaround, consider restricting access to the Jenkins master JVM to minimize the risk of exploitation.

Exploit

Fix

RCE

Protection Mechanism Failure

Weakness Enumeration

CWE-20

CWE-693

Related Identifiers

BDU:2019-02071

CVE-2019-1003030

GHSA-R6MC-MRVR-23CR

RHSA-2019:0739

Affected Products

Jenkins

Jenkins Pipeline: Groovy Plugin

References · 18

• 🔥 http://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html · Exploit
• 🔥 https://exploit-db.com/exploits/48904 · Exploit
• 🔥 https://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html · Exploit
• https://access.redhat.com/errata/RHSA-2019:0739 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1003030 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1003030 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02071 · Security Note
• https://osv.dev/vulnerability/GHSA-r6mc-mrvr-23cr · Vendor Advisory
• https://github.com/jenkinsci/workflow-cps-plugin · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003030 · Note
• https://t.me/cvenotify/111915 · Telegram Post
• https://cvedetails.com/cve/CVE-2019-1003030 · Note
• https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(2) · Note
• https://t.me/cveNotify/140291 · Telegram Post
• http://securityfocus.com/bid/107476 · Note