CVE-2019-1003000
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
- Affected products
- Jenkins, Script Security Plugin
- Jenkins Script Security
- ≤ 1.49
- CVSS 3.1
- 8.8 HIGH
- EPSS
- 98.4% (100th percentile)
- NVD status
- Modified
- Published
- 2019-01-22
CVE-2019-1003000 at NVD
20 known exploits for CVE-2019-1003000
Proof-of-concept code and exploit modules indexed by Sploitus
pwn_jenkins
cve-2019-1003000-jenkins-rce-poc
Jenkins_CVE-2019-1003000
CVE-2019-1003000-and-CVE-2018-1999002-Pre-Auth-RCE-Jenkins
CVE-2019-1003000_RCE-DETECTION
Exploit for CVE-2019-1003000
Exploit for CVE-2019-1003000
Exploit for CVE-2019-1003000
Exploit for CVE-2019-1003000
Exploit for CVE-2019-1003000
Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming RCE Exploit
Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)
Jenkins ACL Bypass / Metaprogramming Remote Code Execution
Jenkins Plugin Script Security 1.49Declarative 1.3.4Groovy 2.60 - Remote Code Execution
Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution
Jenkins Script Security 1.49 / Declarative 1.3.4 / Groovy 2.60 Remote Code Execution
Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution Exploit
Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)
Exploit for CVE-2019-1003000
Exploit for OS Command Injection in Pfsense