{"id":"CVE-2019-1003001","published":"2019-01-22T14:00:00Z","modified":"2024-08-05T03:00:19Z","title":"A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in…","vendor":"Jenkins project","product":"Pipeline: Groovy Plugin","tier":"core","eol":null,"affectedVersions":[{"vendor":"Jenkins project","product":"Pipeline: Groovy Plugin","versions":["2.61 and earlier"]}],"description":{"text":"A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.","provenance":"source","from":"CVE.org"},"summary":{"text":"A sandbox bypass in the Pipeline: Groovy Plugin for Jenkins, in the CpsFlowDefinition.java and CpsGroovyShellFactory.java components, is the flaw. An attacker holding Overall/Read permission can submit a pipeline script to an HTTP endpoint and execute arbitrary code on the Jenkins master JVM.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:47Z"},"cvss":null,"epss":{"score":0.86054,"percentile":0.99729,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-04-15","exploitedFirstSeen":"2024-04-15","ransomware":false,"evidence":[{"url":"https://veriti.ai/blog/vulnerable-villain-when-hackers-get-hacked/","date":"2024-04-15"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":4,"pulses":[{"name":"invoke-mimikatz.hasthe.technology","url":"https://otx.alienvault.com/pulse/676af0f2663cdd2f25ed9e80","created":"2024-12-24"},{"name":"rogers","url":"https://otx.alienvault.com/pulse/64ab46ec79ba3a3f9f859541","created":"2023-07-09"},{"name":"rogers","url":"https://otx.alienvault.com/pulse/64ab412e96e4858e508978c7","created":"2023-07-09"},{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0326","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html","tags":["x_refsource_MISC"]},{"url":"http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming","tags":["x_refsource_MISC"]},{"url":"https://www.exploit-db.com/exploits/46572/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins.workflow:workflow-cps-parent","vulnerableRanges":["<2.61.1"],"patched":["2.61.1"],"from":["GHSA-6q78-6xvr-26fg"],"provenance":"source"},{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:pipeline-model-definition","vulnerableRanges":["<1.3.4.1"],"patched":["1.3.4.1"],"from":["GHSA-6q78-6xvr-26fg"],"provenance":"source"},{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","vulnerableRanges":["<1.50"],"patched":["1.50"],"from":["GHSA-6q78-6xvr-26fg"],"provenance":"source"}],"advisories":[{"id":"GHSA-6q78-6xvr-26fg","url":"https://github.com/advisories/GHSA-6q78-6xvr-26fg","severity":"HIGH","ecosystem":"Maven","package":"org.jenkins-ci.plugins.workflow:workflow-cps-parent","vulnerableRanges":["<2.61.1"],"patched":["2.61.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-6q78-6xvr-26fg","url":"https://github.com/advisories/GHSA-6q78-6xvr-26fg","severity":"HIGH","ecosystem":"Maven","package":"org.jenkins-ci.plugins:pipeline-model-definition","vulnerableRanges":["<1.3.4.1"],"patched":["1.3.4.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-6q78-6xvr-26fg","url":"https://github.com/advisories/GHSA-6q78-6xvr-26fg","severity":"HIGH","ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","vulnerableRanges":["<1.50"],"patched":["1.50"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-2846","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2846","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":46427,"url":"https://www.exploit-db.com/exploits/46427","title":"Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)","type":"webapps","platform":"java","date":"2019-02-19","verified":true,"provenance":"source"},{"id":46572,"url":"https://www.exploit-db.com/exploits/46572","title":"Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)","type":"remote","platform":"java","date":"2019-03-19","verified":true,"provenance":"source"},{"id":46572,"url":"https://www.exploit-db.com/exploits/46572","title":"Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)","type":"remote","platform":"java","date":"2019-03-19","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2019-02-19"},"metasploit":[{"name":"Jenkins ACL Bypass and Metaprogramming RCE","module":"exploit/multi/http/jenkins_metaprogramming","type":"exploit","disclosureDate":"2019-01-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_metaprogramming.rb"}],"first":{"date":"2019-01-08","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_metaprogramming.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/46572/","http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html","https://www.exploit-db.com/exploits/46572"],"flow":[],"timeline":[{"date":"2019-01-08","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2019-02-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_metaprogramming.rb","provenance":"source"},{"date":"2019-01-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-1003001","provenance":"source"},{"date":"2024-04-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://veriti.ai/blog/vulnerable-villain-when-hackers-get-hacked/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":61.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 927 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9973"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 3 Exploit-DB entries; 1 NVD exploit link; 1 advisory exploit reference; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2018-1000865","published":"2018-12-10","fixed":"1.48","kev":false},{"cve":"CVE-2018-1000866","published":"2018-12-10","fixed":"1.48","kev":false,"link":{"from":"CVE-2018-1000866","to":"CVE-2019-1003001","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:script-security","fromFixed":"1.48","toFixed":"1.50","daysApart":43},{"kind":"similar","provenance":"machine","score":0.45,"basis":"same package + description similarity"}]}},{"cve":"CVE-2019-1003000","published":"2019-01-22","fixed":"1.50","kev":false},{"cve":"CVE-2019-1003001","published":"2019-01-22","fixed":"1.50","kev":false},{"cve":"CVE-2019-1003005","published":"2019-02-06","fixed":"1.51","kev":false,"link":{"from":"CVE-2019-1003001","to":"CVE-2019-1003005","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:script-security","fromFixed":"1.50","toFixed":"1.51","daysApart":15},{"kind":"similar","provenance":"machine","score":0.59,"basis":"same package + description similarity"}]}},{"cve":"CVE-2019-1003024","published":"2019-02-20","fixed":"1.53","kev":false},{"cve":"CVE-2019-1003029","published":"2019-03-08","fixed":"1.54","kev":true}],"package":"Maven:org.jenkins-ci.plugins:script-security"}}