Script security sandbox bypass in Matrix Project Plugin

CRITICAL 9.9CVE-2019-1003031 · GHSA-qxf8-8837-hq7w · Published 08/03/2019 · updated 17/06/2026

In short

CVE-2019-1003031 is a CRITICAL (CVSS 9.9) vulnerability affecting org.jenkins-ci.plugins:matrix-project, matrix project (jenkins), openshift container platform (redhat).
Chance of exploitation in the next 30 days (EPSS): 3.5%, higher than 89.0% of all vulnerabilities.
Fix: update to 1.14 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:matrix-project Maven	`< 1.14`	`1.14`
matrix project jenkins	`≤ 1.13`	No fix yet
openshift container platform redhat	`= 3.11`	No fix yet

Description

A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-1003031 · ADVISORY
jenkinsci/matrix-project-plugin commit 765fc39 · WEB
access.redhat.com/errata/RHSA-2019:0739 · WEB
jenkinsci/matrix-project-plugin · PACKAGE
jenkins.io/security/advisory/2019-03-06 · WEB
securityfocus.com/bid/107476 · WEB

More vulnerabilities in org.jenkins-ci.plugins:matrix-project

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:matrix-project

Maven

< 1.14

1.14

matrix project

jenkins

≤ 1.13

No fix yet

openshift container platform

redhat

= 3.11

No fix yet

Description

NVD description

More vulnerabilities in org.jenkins-ci.plugins:matrix-project

See all →