CVE-2019-1003029

Fixed in a distro release ExploitedEPSS 74%CVSS 9.9

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

Published 2019-03-08 · In CISA KEV since 2022-04-25 · CVE record · OSV

Products: Jenkins project Jenkins Script Security Plugin

Fixed upstream

Ecosystem	Package	Fixed in
Maven	org.jenkins-ci.plugins:script-security	1.54

Distro releases

Release	Package	Fixed in
Red Hat openshift 3.11	jenkins-2-plugins	0:3.11.1552336312-1.el7