Jenkins project · Script Security Plugin
The Script Security Plugin for Jenkins, version 1.49 and earlier, contains a sandbox bypass flaw in its GroovySandbox.java component. An attacker who is able to supply sandboxed scripts can use it to execute arbitrary code on the Jenkins master JVM.
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
First seen exploited 12 months after disclosure. Public exploit code (PoC-in-GitHub) was available 21 months before disclosure.
7 fixes in script-security over 13 months. The latest fix listed for script-security is 1.53.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.jenkins-ci.plugins:script-security.
Upgrade to 1.54 or later
Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2019-1003001, CVE-2019-1003029).
Set the version to 1.54 or later in your pom.xml or build.gradle.
First fixed in 1.50 for CVE-2019-1003000.
| If you run | Upgrade to |
|---|---|
| All versions before 1.50 | 1.54first fix for this CVE: 1.50 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.