CVE-2019-1003001
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
- Affected products
- Groovy Plugin, Jenkins, Pipeline
- Jenkins Pipeline\: Groovy
- ≤ 2.61
- CVSS 3.1
- 8.8 HIGH
- EPSS
- 86.1% (100th percentile)
- NVD status
- Modified
- Published
- 2019-01-22
CVE-2019-1003001 at NVD
10 known exploits for CVE-2019-1003001
Proof-of-concept code and exploit modules indexed by Sploitus
pwn_jenkins
Exploit for CVE-2019-1003000
Exploit for CVE-2019-1003000
Exploit for CVE-2019-1003000
Exploit for CVE-2019-1003000
Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming RCE Exploit
Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)
Jenkins ACL Bypass / Metaprogramming Remote Code Execution
Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)
Exploit for CVE-2019-1003000