{"id":"CVE-2019-1003000","published":"2019-01-22T14:00:00Z","modified":"2024-08-05T03:00:19Z","title":"A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in…","vendor":"Jenkins project","product":"Script Security Plugin","tier":"core","eol":null,"affectedVersions":[{"vendor":"Jenkins project","product":"Script Security Plugin","versions":["1.49 and earlier"]}],"description":{"text":"A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Script Security Plugin for Jenkins, version 1.49 and earlier, contains a sandbox bypass flaw in its GroovySandbox.java component. An attacker who is able to supply sandboxed scripts can use it to execute arbitrary code on the Jenkins master JVM.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:05Z"},"cvss":null,"epss":{"score":0.98375,"percentile":0.99918,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2020-01-31","exploitedFirstSeen":"2020-01-31","ransomware":false,"evidence":[{"url":"https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities--exploits--and-malware-driving-attack-campaigns-in-december-2019","date":"2020-01-31"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-16&host_type=src&vulnerability=cve-2019-1003000","date":"2026-09-16"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":8,"pulses":[{"name":"invoke-mimikatz.hasthe.technology","url":"https://otx.alienvault.com/pulse/676af0f2663cdd2f25ed9e80","created":"2024-12-24"},{"name":"IOC's found on my pesonal devices; week starting 08/14/23","url":"https://otx.alienvault.com/pulse/65709ffcf3ffe737f8cb8dfd","created":"2023-12-06"},{"name":"IOC's found on my pesonal devices; week starting 08/14/23","url":"https://otx.alienvault.com/pulse/64dd9c1d76a7807782a691d3","created":"2023-08-17"},{"name":"rogers","url":"https://otx.alienvault.com/pulse/64ab46ec79ba3a3f9f859541","created":"2023-07-09"},{"name":"rogers","url":"https://otx.alienvault.com/pulse/64ab412e96e4858e508978c7","created":"2023-07-09"},{"name":"Rocke Group Actively Targeting the Cloud: Wants Your SSH Keys","url":"https://otx.alienvault.com/pulse/606f59766e59371c075fe3c8","created":"2021-04-08"},{"name":"Rocke Group Actively Targeting the Cloud: Wants Your SSH Keys","url":"https://otx.alienvault.com/pulse/606f5973a214488ae57f0f15","created":"2021-04-08"},{"name":"WatchBog Mining Malware Exploiting Jira Servers","url":"https://otx.alienvault.com/pulse/5d35958a9983df3a51f1a3b9","created":"2019-07-22"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266","tags":["x_refsource_CONFIRM"]},{"url":"https://www.exploit-db.com/exploits/46453/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0326","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html","tags":["x_refsource_MISC"]},{"url":"http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming","tags":["x_refsource_MISC"]},{"url":"https://www.exploit-db.com/exploits/46572/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","vulnerableRanges":["<1.50"],"patched":["1.50"],"from":["GHSA-784j-h234-m56x"],"provenance":"source"}],"advisories":[{"id":"GHSA-784j-h234-m56x","url":"https://github.com/advisories/GHSA-784j-h234-m56x","severity":"HIGH","ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","vulnerableRanges":["<1.50"],"patched":["1.50"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-2948","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2948","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":46427,"url":"https://www.exploit-db.com/exploits/46427","title":"Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)","type":"webapps","platform":"java","date":"2019-02-19","verified":true,"provenance":"source"},{"id":46453,"url":"https://www.exploit-db.com/exploits/46453","title":"Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution","type":"webapps","platform":"java","date":"2019-02-25","verified":false,"provenance":"source"},{"id":46572,"url":"https://www.exploit-db.com/exploits/46572","title":"Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)","type":"remote","platform":"java","date":"2019-03-19","verified":true,"provenance":"source"},{"id":46572,"url":"https://www.exploit-db.com/exploits/46572","title":"Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)","type":"remote","platform":"java","date":"2019-03-19","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2019-02-19"},"pocGithub":{"count":5,"skipped":0,"earliest":"2017-04-26","earliestUrl":"https://github.com/wetw0rk/Exploit-Development","repos":[{"name":"adamyordan/cve-2019-1003000-jenkins-rce-poc","url":"https://github.com/adamyordan/cve-2019-1003000-jenkins-rce-poc","stars":316,"created":"2019-02-15"},{"name":"wetw0rk/Exploit-Development","url":"https://github.com/wetw0rk/Exploit-Development","stars":83,"created":"2017-04-26"},{"name":"1NTheKut/CVE-2019-1003000_RCE-DETECTION","url":"https://github.com/1NTheKut/CVE-2019-1003000_RCE-DETECTION","stars":4,"created":"2019-04-24"},{"name":"purple-WL/Jenkins_CVE-2019-1003000","url":"https://github.com/purple-WL/Jenkins_CVE-2019-1003000","stars":1,"created":"2022-02-12"},{"name":"im23pds/CVE-2019-1003000-and-CVE-2018-1999002-Pre-Auth-RCE-Jenkins","url":"https://github.com/im23pds/CVE-2019-1003000-and-CVE-2018-1999002-Pre-Auth-RCE-Jenkins","stars":0,"created":"2019-03-06"}]},"metasploit":[{"name":"Jenkins ACL Bypass and Metaprogramming RCE","module":"exploit/multi/http/jenkins_metaprogramming","type":"exploit","disclosureDate":"2019-01-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_metaprogramming.rb"}],"nuclei":[{"id":"CVE-2019-1003000","name":"Jenkins Script Security Plugin <=1.49 - Sandbox Bypass","severity":"high","path":"http/cves/2019/CVE-2019-1003000.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1003000.yaml"}],"first":{"date":"2017-04-26","source":"PoC-in-GitHub","url":"https://github.com/wetw0rk/Exploit-Development"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/46453/","https://www.exploit-db.com/exploits/46572/","http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html","https://www.exploit-db.com/exploits/46453","https://www.exploit-db.com/exploits/46572"],"flow":[],"timeline":[{"date":"2017-04-26","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2019-01-08, Exploit-DB 2019-02-19","url":"https://github.com/wetw0rk/Exploit-Development","provenance":"source"},{"date":"2019-01-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-1003000","provenance":"source"},{"date":"2020-01-31","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities--exploits--and-malware-driving-attack-campaigns-in-december-2019","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":62.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2463 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 4 Exploit-DB entries; 1 NVD exploit link; 2 advisory exploit references; 5 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2017-1000505","published":"2018-01-25","fixed":"1.37","kev":false},{"cve":"CVE-2018-1000865","published":"2018-12-10","fixed":"1.48","kev":false},{"cve":"CVE-2018-1000866","published":"2018-12-10","fixed":"1.48","kev":false,"link":{"from":"CVE-2018-1000866","to":"CVE-2019-1003000","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:script-security","fromFixed":"1.48","toFixed":"1.50","daysApart":43}]}},{"cve":"CVE-2019-1003000","published":"2019-01-22","fixed":"1.50","kev":false},{"cve":"CVE-2019-1003001","published":"2019-01-22","fixed":"1.50","kev":false},{"cve":"CVE-2019-1003005","published":"2019-02-06","fixed":"1.51","kev":false},{"cve":"CVE-2019-1003024","published":"2019-02-20","fixed":"1.53","kev":false}],"package":"Maven:org.jenkins-ci.plugins:script-security"}}