CVE-2019-1003029

Katalog CVE

CVSS 9.9 · Critical KEV · sudah dieksploitasi EPSS 74,4%

Kerentanan pada jenkins script security, redhat openshift container platform. Skor CVSS 3.1 9.9 (Critical) menurut NVD. Masuk katalog KEV CISA pada 25 April 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

Rincian

Terbit di NVD

8 Maret 2019

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

74,4% peluang dieksploitasi; lebih tinggi dari 99,4% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Jenkins Script Security Plugin Sandbox Bypass Vulnerability

Masuk KEV

25 April 2022

Tenggat CISA

16 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003029 pemerintah AS
• http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/bid/107476 broken link · advisory pihak ketiga · vdb entry
• https://access.redhat.com/errata/RHSA-2019:0739 advisory pihak ketiga
• https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29 advisory pihak ketiga