{"id":"CVE-2019-1003031","published":"2019-03-08T21:00:00Z","modified":"2024-08-05T03:00:19Z","title":"A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml…","vendor":"Jenkins","product":"Jenkins Matrix Project Plugin","tier":"tail","description":{"text":"A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03459,"percentile":0.88992,"provenance":"source"},"cwes":[],"references":[{"url":"https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1339","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/107476","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0739","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":17.8,"factors":[{"name":"EPSS percentile","points":17.8}]},"vendorSlug":"jenkins","affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins Matrix Project Plugin","versions":["1.13 and earlier"]}],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:matrix-project","vulnerableRanges":["<1.14"],"patched":["1.14"],"from":["GHSA-qxf8-8837-hq7w"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5059","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2019-1003031","published":"2019-03-08","fixed":"1.14","kev":false},{"cve":"CVE-2020-2224","published":"2020-07-15","fixed":"1.17","kev":false,"link":{"from":"CVE-2019-1003031","to":"CVE-2020-2224","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:matrix-project","fromFixed":"1.14","toFixed":"1.17","daysApart":495}]}},{"cve":"CVE-2020-2225","published":"2020-07-15","fixed":"1.17","kev":false,"link":{"from":"CVE-2019-1003031","to":"CVE-2020-2225","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:matrix-project","fromFixed":"1.14","toFixed":"1.17","daysApart":495}]}},{"cve":"CVE-2022-20615","published":"2022-01-12","fixed":"1.20","kev":false}],"package":"Maven:org.jenkins-ci.plugins:matrix-project"}}