CVE-2019-1003030

Warnung

Exploit

EPSS 93.01%
Veröffentlicht 08.03.2019 21:29:00
Zuletzt bearbeitet 20.02.2025 18:04:29
Quelle jenkinsci-cert@googlegroups.co
Teams Watchlist Login
Unerledigt Login

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Betroffene Produkte Warnungen 1 Metriken 4 CWE 1 Referenzen 7

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Jenkins ≫ Pipeline: Groovy SwPlatformjenkins Version <= 2.63

Redhat ≫ Openshift Container Platform Version3.11

25.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Jenkins Matrix Project Plugin Remote Code Execution Vulnerability

Schwachstelle

Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	93.01%	0.998

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.9	3.1	6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvd@nist.gov	6.5	8	6.4	AV:N/AC:L/Au:S/C:P/I:P/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0	9.9	3.1	6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H