Protection Mechanism Failure in Jenkins Script Security Plugin

HIGH 8.8CVE-2019-1003000 · GHSA-784j-h234-m56x · Published 22/01/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:script-security Maven	`< 1.50`	`1.50`
script security jenkins	`≤ 1.49`	No fix yet
openshift container platform redhat	`= 3.11`	No fix yet

Description

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-1003000 · ADVISORY
jenkinsci/script-security-plugin commit 2c5122e · WEB
access.redhat.com/errata/RHBA-2019:0326 · WEB
access.redhat.com/errata/RHBA-2019:0327 · WEB
jenkins.io/security/advisory/2019-01-08 · WEB
exploit-db.com/exploits/46453 · WEB
exploit-db.com/exploits/46572 · WEB
packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html · WEB
rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming · WEB
exploit-db.com/exploits/46453 · Exploit
exploit-db.com/exploits/46572 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free