CVE-2019-1003002
- Source
- https://cve.org/CVERecord?id=CVE-2019-1003002
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-1003002.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2019-1003002
- Aliases
- Downstream
- Published
- 2019-01-22T14:29:00.390Z
- Modified
- 2026-01-29T05:07:19.247352Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
- References
-
- http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html
- http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming
- https://access.redhat.com/errata/RHBA-2019:0326
- https://access.redhat.com/errata/RHBA-2019:0327
- https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266
- https://www.exploit-db.com/exploits/46572/
- http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/46572/
Affected packages
Git / github.com/jenkinsci/pipeline-model-definition-plugin
Affected ranges
- Type
- GIT
- Repo
- https://github.com/jenkinsci/pipeline-model-definition-plugin
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected
Affected versions
pipeline-model-definition-0.*
pipeline-model-definition-0.1
pipeline-model-definition-0.2
pipeline-model-definition-0.3
pipeline-model-definition-0.4
pipeline-model-definition-0.5
pipeline-model-definition-0.6
pipeline-model-definition-0.7
pipeline-model-definition-0.7.1
pipeline-model-definition-0.8
pipeline-model-definition-0.8.1
pipeline-model-definition-0.8.2
pipeline-model-definition-0.9
pipeline-model-definition-0.9.1
pipeline-model-definition-1.*
pipeline-model-definition-1.0
pipeline-model-definition-1.0.1
pipeline-model-definition-1.0.2
pipeline-model-definition-1.1
pipeline-model-definition-1.1.1
pipeline-model-definition-1.1.2
pipeline-model-definition-1.1.3
pipeline-model-definition-1.1.4
pipeline-model-definition-1.1.5
pipeline-model-definition-1.1.6
pipeline-model-definition-1.1.7
pipeline-model-definition-1.1.8
pipeline-model-definition-1.1.9
pipeline-model-definition-1.2
pipeline-model-definition-1.2-beta-4
pipeline-model-definition-1.2-beta-5
pipeline-model-definition-1.2.1
pipeline-model-definition-1.2.2
pipeline-model-definition-1.2.3
pipeline-model-definition-1.2.4
pipeline-model-definition-1.2.5
pipeline-model-definition-1.2.6
pipeline-model-definition-1.2.7
pipeline-model-definition-1.2.8
pipeline-model-definition-1.2.9
pipeline-model-definition-1.3
pipeline-model-definition-1.3.1
pipeline-model-definition-1.3.2
pipeline-model-definition-1.3.3