CVE-2019-1003001
- Source
- https://cve.org/CVERecord?id=CVE-2019-1003001
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-1003001.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2019-1003001
- Aliases
- Downstream
- Published
- 2019-01-22T14:29:00.330Z
- Modified
- 2026-01-29T05:07:13.670473Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
- References
-
- http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html
- http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming
- https://access.redhat.com/errata/RHBA-2019:0326
- https://access.redhat.com/errata/RHBA-2019:0327
- https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266
- https://www.exploit-db.com/exploits/46572/
- http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/46572/
Affected packages
Git / github.com/jenkinsci/workflow-cps-plugin
Affected ranges
- Type
- GIT
- Repo
- https://github.com/jenkinsci/workflow-cps-plugin
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected
Affected versions
workflow-cps-2.*
workflow-cps-2.0
workflow-cps-2.1
workflow-cps-2.10
workflow-cps-2.11
workflow-cps-2.12
workflow-cps-2.13
workflow-cps-2.14
workflow-cps-2.15
workflow-cps-2.16
workflow-cps-2.17
workflow-cps-2.18
workflow-cps-2.19
workflow-cps-2.2
workflow-cps-2.20
workflow-cps-2.21
workflow-cps-2.22
workflow-cps-2.23
workflow-cps-2.24
workflow-cps-2.25
workflow-cps-2.26
workflow-cps-2.27
workflow-cps-2.28
workflow-cps-2.29
workflow-cps-2.3
workflow-cps-2.30
workflow-cps-2.31
workflow-cps-2.32
workflow-cps-2.33
workflow-cps-2.34
workflow-cps-2.35
workflow-cps-2.36
workflow-cps-2.37
workflow-cps-2.38
workflow-cps-2.39
workflow-cps-2.4
workflow-cps-2.40
workflow-cps-2.41
workflow-cps-2.42
workflow-cps-2.43
workflow-cps-2.44
workflow-cps-2.45
workflow-cps-2.46
workflow-cps-2.47
workflow-cps-2.48
workflow-cps-2.49
workflow-cps-2.5
workflow-cps-2.50
workflow-cps-2.51
workflow-cps-2.52
workflow-cps-2.53
workflow-cps-2.54
workflow-cps-2.55
workflow-cps-2.56
workflow-cps-2.57
workflow-cps-2.58
workflow-cps-2.58-beta-1
workflow-cps-2.59
workflow-cps-2.6
workflow-cps-2.60
workflow-cps-2.61
workflow-cps-2.7
workflow-cps-2.8
workflow-cps-2.9