Cyber Resilience

CVE-2019-1003001

Jenkins Pipeline\ _groovy

Public PoCHigh EPSS
Published
22 January 2019
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.86 99.7th percentile
Risk Priority 87 floored blend · peak EPSS

Summary

CVE-2019-1003001 is a high-severity an unspecified weakness vulnerability in Jenkins Pipeline\. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins…

more

master JVM.

CWE(s)
NVD-CWE-Other

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
The vulnerability allows remote code execution via an HTTP endpoint on the Jenkins master, directly matching exploitation of a public-facing application.
attack.mitre.org →
T1059.006 Python Executionconfidence: HIGH
The flaw enables arbitrary Groovy code execution on the Jenkins master JVM through a pipeline script.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: MEDIUM
Attackers with only Overall/Read permission can escalate to arbitrary code execution, indicating privilege escalation via exploitation.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2019-1003030Same product: Jenkins Pipeline\
CVE-2019-1003002Same product: Jenkins Pipeline\
CVE-2019-1003029Same product: Redhat Openshift Container Platform
CVE-2018-1000861Same product: Redhat Openshift Container Platform
CVE-2019-1003000Same product: Redhat Openshift Container Platform
CVE-2015-8103Same product: Redhat Openshift Container Platform
CVE-2024-7079Same product: Redhat Openshift Container Platform
CVE-2024-50312Same product: Redhat Openshift Container Platform
CVE-2024-50311Same product: Redhat Openshift Container Platform
CVE-2026-57283Same product: Jenkins Pipeline\

Affected Assets

jenkins
pipeline\
_groovy
redhat
openshift container platform
3.11

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References