Cyber Resilience

CVE-2019-1003000

Jenkins Script Security ≤ 1.49

Public PoCHigh EPSS
Published
22 January 2019
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.98 99.9th percentile
Risk Priority 87 floored blend · peak EPSS

Summary

CVE-2019-1003000 is a high-severity an unspecified weakness vulnerability in Jenkins Script Security. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.

CWE(s)
NVD-CWE-Other

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1059.006 Python Executionconfidence: HIGH
Sandbox bypass in Groovy script execution directly enables arbitrary code execution via Python-like scripting on the Jenkins master.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Bypassing the Groovy sandbox allows privilege escalation from limited script permissions to full JVM code execution.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
The vulnerability is triggered by providing malicious input to a publicly exposed Jenkins scripting interface.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2019-1003029Same product: Jenkins Script Security
CVE-2019-1003030Same product: Redhat Openshift Container Platform
CVE-2018-1000861Same product: Redhat Openshift Container Platform
CVE-2019-1003002Same product: Redhat Openshift Container Platform
CVE-2015-8103Same product: Redhat Openshift Container Platform
CVE-2019-1003001Same product: Redhat Openshift Container Platform
CVE-2026-57280Same product: Jenkins Script Security
CVE-2024-7079Same product: Redhat Openshift Container Platform
CVE-2024-50312Same product: Redhat Openshift Container Platform
CVE-2024-50311Same product: Redhat Openshift Container Platform

Affected Assets

jenkins
script security
≤ 1.49
redhat
openshift container platform
3.11

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References