Actively exploited · Published Mar 8, 2019 · Assigned by jenkins
CVE-2019-1003029
Critical 9.9 Exploited
In plain English
A critical-severity security flaw in Jenkins Script Security Plugin from Jenkins project. Attackers are actively exploiting it in the wild (listed by CISA on April 25, 2022). The chance it is exploited in the next 30 days is estimated at 74.4% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 16, 2022.
Official description
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:script-security | 1.54 | GHSA-xvxq-hq48-xphm |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Jenkins project | Jenkins Script Security Plugin | 1.53 and earlier |
References
- https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29 x_refsource_CONFIRM
- 107476 vdb-entry, x_refsource_BID
- RHSA-2019:0739 vendor-advisory, x_refsource_REDHAT
- http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003029 government-resource