CVE-2019-1003006: High severity jenkins vulnerability
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM. In version 2.1, the affected HTTP endpoint applies a safe Groovy compiler configuration preventing the use of unsafe AST transforming annotations.
Other sources
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1003006?
CVE-2019-1003006 has a high severity rating due to its potential for arbitrary code execution.
How do I fix CVE-2019-1003006?
To fix CVE-2019-1003006, upgrade the Jenkins Groovy Plugin to version 2.1 or later.
What systems are affected by CVE-2019-1003006?
CVE-2019-1003006 affects Jenkins Groovy Plugin versions 2.0 and earlier.
What type of attack can CVE-2019-1003006 enable?
CVE-2019-1003006 can enable attackers with Overall/Read permission to execute arbitrary code.
Is CVE-2019-1003006 related to Jenkins user permissions?
Yes, CVE-2019-1003006 exploits user permissions specifically the Overall/Read permission within Jenkins.