CVE-2019-1003002
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
- Affected products
- Jenkins, Pipeline: Declarative Plugin
- Jenkins Pipeline\: Declarative
- ≤ 1.3.3
- CVSS 3.1
- 8.8 HIGH
- EPSS
- 81.4% (100th percentile)
- NVD status
- Modified
- Published
- 2019-01-22
CVE-2019-1003002 at NVD
11 known exploits for CVE-2019-1003002
Proof-of-concept code and exploit modules indexed by Sploitus
pwn_jenkins
cve-2019-1003000-jenkins-rce-poc
Exploit for CVE-2019-1003000
Exploit for CVE-2019-1003000
Exploit for CVE-2019-1003000
Exploit for CVE-2019-1003000
Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming RCE Exploit
Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)
Jenkins ACL Bypass / Metaprogramming Remote Code Execution
Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)
Exploit for CVE-2019-1003000