Script security sandbox bypass in Matrix Project Plugin

严重 9.9CVE-2019-1003031 · GHSA-qxf8-8837-hq7w · Published 08/03/2019 · updated 17/06/2026

要点

CVE-2019-1003031 是影响 org.jenkins-ci.plugins:matrix-project, matrix project (jenkins), openshift container platform (redhat) 的严重 (CVSS 9.9)漏洞。
未来 30 天内被利用的概率（EPSS）：3.5%，高于 89.0% 的漏洞。
修复：升级到 1.14 或更高版本。

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:matrix-project Maven	`< 1.14`	`1.14`
matrix project jenkins	`≤ 1.13`	No fix yet
openshift container platform redhat	`= 3.11`	No fix yet

Description

A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-1003031 · ADVISORY
jenkinsci/matrix-project-plugin commit 765fc39 · WEB
access.redhat.com/errata/RHSA-2019:0739 · WEB
jenkinsci/matrix-project-plugin · PACKAGE
jenkins.io/security/advisory/2019-03-06 · WEB
securityfocus.com/bid/107476 · WEB

org.jenkins-ci.plugins:matrix-project 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:matrix-project

Maven

< 1.14

1.14

matrix project

jenkins

≤ 1.13

No fix yet

openshift container platform

redhat

= 3.11

No fix yet

Description

NVD description

org.jenkins-ci.plugins:matrix-project 的其他漏洞

查看全部 →