Jenkins Groovy Plugin sandbox bypass vulnerability

HOCH 8.8CVE-2019-1003033 · GHSA-fm3j-r98g-97jh · Published 08/03/2019 · updated 17/06/2026

Kurz gesagt

CVE-2019-1003033 ist eine Schwachstelle (HOCH (CVSS 8.8)) in org.jenkins-ci.plugins:groovy, groovy (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.5%, höher als bei 85.0% aller Schwachstellen.
Abhilfe: auf 2.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:groovy Maven	`< 2.2`	`2.2`
groovy jenkins	`≤ 2.1`	No fix yet

Description

A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. Groovy Plugin 2.2 uses Script Security APIs that apply sandbox protection during these phases.

NVD description

A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

References

nvd.nist.gov/vuln/detail/CVE-2019-1003033 · ADVISORY
jenkinsci/groovy-plugin commit 40777c2 · WEB
jenkins.io/security/advisory/2019-03-06 · WEB
securityfocus.com/bid/107476 · WEB

Weitere Schwachstellen in org.jenkins-ci.plugins:groovy

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:groovy

Maven

< 2.2

2.2

groovy

jenkins

≤ 2.1

No fix yet

Description

NVD description