CVE-2019-1003000: High severity jenkins script security vulnerability
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1003000?
CVE-2019-1003000 is classified as a critical vulnerability due to its potential to allow arbitrary code execution on the Jenkins master JVM.
How do I fix CVE-2019-1003000?
To mitigate CVE-2019-1003000, upgrade the Jenkins Script Security Plugin to version 1.50 or later.
Who is affected by CVE-2019-1003000?
CVE-2019-1003000 affects users of Jenkins Script Security Plugin versions 1.49 and earlier and Red Hat OpenShift Container Platform version 3.11.
What type of attack does CVE-2019-1003000 allow?
CVE-2019-1003000 allows attackers to bypass the sandbox restrictions and execute arbitrary scripts on the Jenkins master instance.
How was CVE-2019-1003000 discovered?
CVE-2019-1003000 was identified through security assessments highlighting the misconfiguration in the GroovySandbox class.