Script security sandbox bypass in Jenkins Email Extension Plugin

CRITICAL 9.9CVE-2019-1003032 · GHSA-qwm8-vgm6-f86p · Published 08/03/2019 · updated 17/06/2026

In short

CVE-2019-1003032 is a CRITICAL (CVSS 9.9) vulnerability affecting org.jenkins-ci.plugins:email-ext, email extension (jenkins).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.3% of all vulnerabilities.
Fix: update to 2.65 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:email-ext Maven	`< 2.65`	`2.65`
email extension jenkins	`≤ 2.64`	No fix yet

Description

A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-1003032 · ADVISORY
jenkinsci/email-ext-plugin · PACKAGE
jenkins.io/security/advisory/2019-03-06 · WEB
securityfocus.com/bid/107476 · WEB

More vulnerabilities in org.jenkins-ci.plugins:email-ext

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:email-ext

Maven

< 2.65

2.65

email extension

jenkins

≤ 2.64

No fix yet

Description

NVD description

More vulnerabilities in org.jenkins-ci.plugins:email-ext

See all →