Actively exploited · Published Mar 8, 2019 · Assigned by jenkins
CVE-2019-1003030
Critical 9.9 Exploited
In plain English
A critical-severity security flaw in Jenkins Pipeline: Groovy Plugin from Jenkins project. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 97.1% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 15, 2022.
Official description
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins.workflow:workflow-cps | 2.64 | GHSA-r6mc-mrvr-23cr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Jenkins project | Jenkins Pipeline: Groovy Plugin | 2.63 and earlier |
Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%282%29 x_refsource_CONFIRM
- 107476 vdb-entry, x_refsource_BID
- RHSA-2019:0739 vendor-advisory, x_refsource_REDHAT
- http://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003030 government-resource