CVE-2019-1003030
Jenkins Pipeline\ _groovy
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2019-1003030 is a critical-severity Protection Mechanism Failure (CWE-693) vulnerability in Jenkins Pipeline\. Its CVSS base score is 9.9 (Critical).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A sandbox bypass vulnerability exists in the Jenkins Pipeline: Groovy Plugin versions 2.63 and earlier, specifically within CpsGroovyShell.java. The flaw permits execution of arbitrary code on the Jenkins master JVM when an attacker can supply or modify pipeline scripts, as indicated by the affected files pom.xml and the associated source path. The issue carries a CVSS 3.1 score of 9.9 and is categorized under protection mechanism failure.
Attackers with the ability to control pipeline scripts, such as users granted pipeline authoring permissions, can exploit the bypass to run code outside the intended Groovy sandbox. This grants them full access to the Jenkins master process, enabling impacts across confidentiality, integrity, and availability on the controller.
The Jenkins security advisory for SECURITY-1336 and the associated Red Hat errata RHSA-2019:0739 address remediation steps, including updates that restrict script execution to prevent the sandbox escape. Public exploit code referencing Jenkins 2.63 has been published, confirming the issue's practical exploitability in unpatched environments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-5117
Vulnerability Data
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
- CWE(s)
- KEV Date Added
- 25 March 2022
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Implements a reliable, tamperproof protection mechanism whose completeness can be assured.
Procedures for training on protection mechanisms reduce the chance of protection mechanism failures being present or exploitable.
Documented procedures to implement assessment, authorization, and monitoring controls prevent these protection mechanisms from failing due to undefined processes.
Direct evaluation of whether controls produce desired security outcomes detects protection mechanism failures and enables remediation.
Requires assessment that protection mechanisms are correctly implemented and producing intended security outcomes.
The POA&M process ensures identified weaknesses in protection mechanisms are documented and scheduled for remediation, reducing the duration they remain exploitable.
Ongoing control assessments and analysis of monitoring data enable timely detection and response when protection mechanisms fail.
Impact analysis identifies changes that could weaken or disable existing protection mechanisms.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Systematic verification that security mechanisms operate according to defined standards reduces the likelihood that protection mechanisms are bypassed or disabled.
A.8.26 only requires that security requirements (including protection mechanisms) be identified and specified during development or acquisition; it does not itself mandate, implement, or enforce the mechanisms that would remove CWE-693 instances from the product.
A.8.28 mandates secure coding practices, principles, standards, design, peer review, defect removal, prohibition of insecure techniques (e.g. hard-coded passwords), and evaluation of common errors before deployment, which directly removes many instances of missing or incorrectly used protection mechanisms from first-party code; the bounded remainder is third-party components and post-deployment issues handled by other clauses (8.8, 8.29).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.