CVE-2019-1003000
Protection Mechanism Failure in Jenkins Script Security Plugin
8.8 HighPublic exploitFix available
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
98.4%Up 48.7 points since Apr 14, 2021
What each source reports
NVD Score used
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
- Record
CVE-2019-1003000- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
- Record
CVE-2019-1003000- Updated
- 2026-11-02
EUVDEUVD-2022-2948 No score
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
- Record
EUVD-2022-2948- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-784j-h234-m56x
Protection Mechanism Failure in Jenkins Script Security Plugin
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
- Record
GHSA-784j-h234-m56x- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-693
- Updated
- 2026-11-02
OSV
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
- Record
CVE-2019-1003000- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-784j-h234-m56x
Protection Mechanism Failure in Jenkins Script Security Plugin
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
- Record
GHSA-784j-h234-m56x- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-693
- Updated
- 2026-11-02
OSVRHBA-2019:0326
Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update
- Record
RHBA-2019:0326- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:script-securityMaven |
through 1.49 | 1.50 |
org.jenkins-ci.plugins:script-securityMaven |
before 1.50, plus listed versions 1.01.0-beta-11.0-beta-21.0-beta-31.0-beta-4 Show 45 moreShow less1.0-beta-51.0-beta-61.11.101.111.121.131.141.151.161.171.181.18.11.191.21.201.211.221.231.241.251.261.271.281.291.29.11.31.301.311.331.341.351.361.371.381.391.41.401.411.421.431.441.44.11.451.46 |
1.50 |
atomic-enterprise-service-catalogRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 1:3.11.82-1.git.1673.133961e.el7 | 1:3.11.82-1.git.1673.133961e.el7 |
atomic-enterprise-service-catalog-svcatRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 1:3.11.82-1.git.1673.133961e.el7 | 1:3.11.82-1.git.1673.133961e.el7 |
atomic-openshiftRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-clientsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-clients-redistributableRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-cluster-autoscalerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.efb6af0.el7 | 0:3.11.82-1.git.0.efb6af0.el7 |
atomic-openshift-deschedulerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.300.89765c9.el7 | 0:3.11.82-1.git.300.89765c9.el7 |
atomic-openshift-docker-excluderRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
Show 33 moreShow less
| Package | Affected | Fixed |
|---|---|---|
atomic-openshift-dockerregistryRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.452.0ce6383.el7 | 0:3.11.82-1.git.452.0ce6383.el7 |
atomic-openshift-excluderRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-hyperkubeRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-hypershiftRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-masterRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-metrics-serverRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.52.2fdca3f.el7 | 0:3.11.82-1.git.52.2fdca3f.el7 |
atomic-openshift-nodeRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-node-problem-detectorRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.254.a448936.el7 | 0:3.11.82-1.git.254.a448936.el7 |
atomic-openshift-podRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-sdn-ovsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-service-idlerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.14.e353758.el7 | 0:3.11.82-1.git.14.e353758.el7 |
atomic-openshift-template-service-brokerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-testsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-web-consoleRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.355.5e8b1d9.el7 | 0:3.11.82-1.git.355.5e8b1d9.el7 |
golang-github-openshift-oauth-proxyRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.425.7cac034.el7 | 0:3.11.82-1.git.425.7cac034.el7 |
golang-github-prometheus-alertmanagerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.3bf41ce.el7 | 0:3.11.82-1.git.0.3bf41ce.el7 |
golang-github-prometheus-node_exporterRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.1063.48444e8.el7 | 0:3.11.82-1.git.1063.48444e8.el7 |
golang-github-prometheus-prometheusRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.5027.9d24833.el7 | 0:3.11.82-1.git.5027.9d24833.el7 |
haproxyRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:1.8.17-3.el7 | 0:1.8.17-3.el7 |
haproxy-debuginfoRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:1.8.17-3.el7 | 0:1.8.17-3.el7 |
haproxy18Red Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:1.8.17-3.el7 | 0:1.8.17-3.el7 |
jenkinsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:2.150.2.1549032159-1.el7 | 0:2.150.2.1549032159-1.el7 |
jenkins-2-pluginsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.1549642489-1.el7 | 0:3.11.1549642489-1.el7 |
openshift-ansibleRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-ansible-docsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-ansible-playbooksRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-ansible-rolesRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-ansible-testRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-enterprise-autohealRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.219.0b5aff4.el7 | 0:3.11.82-1.git.219.0b5aff4.el7 |
openshift-enterprise-cluster-capacityRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.380.cf11c51.el7 | 0:3.11.82-1.git.380.cf11c51.el7 |
prometheusRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.5027.9d24833.el7 | 0:3.11.82-1.git.5027.9d24833.el7 |
prometheus-alertmanagerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.3bf41ce.el7 | 0:3.11.82-1.git.0.3bf41ce.el7 |
prometheus-node-exporterRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.1063.48444e8.el7 | 0:3.11.82-1.git.1063.48444e8.el7 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | wetw0rk/Exploit-Development | 2017-04-26 |
| Metasploit | Jenkins ACL Bypass and Metaprogramming RCE | 2019-01-08 |
| PoC in GitHub | adamyordan/cve-2019-1003000-jenkins-rce-poc | 2019-02-15 |
| Exploit-DB | Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC) | 2019-02-19 |
| Exploit-DB | Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution | 2019-02-25 |
| PoC in GitHub | im23pds/CVE-2019-1003000-and-CVE-2018-1999002-Pre-Auth-RCE-Jenkins | 2019-03-06 |
| Exploit-DB | Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit) | 2019-03-19 |
| PoC in GitHub | 1NTheKut/CVE-2019-1003000_RCE-DETECTION | 2019-04-24 |
| PoC in GitHub | purple-WL/Jenkins_CVE-2019-1003000 | 2022-02-12 |
| Nuclei | Jenkins Script Security Plugin <=1.49 - Sandbox Bypass |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-1003000 is a high vulnerability (CVSS 8.8) in Jenkins Script Security, published January 22, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.4%, the 99th percentile. Fixed in org.jenkins-ci.plugins:script-security 1.50.
References
jenkins.io/security/advisory/2019-01-08
exploit-db.com/exploits/46453
access.redhat.com/errata/RHBA-2019:0326
packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html
rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming
Show 103 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-1003000
github.com/jenkinsci/script-security-plugin/commit/2c5122e50742dd16492f9424992deb21cc07837c
bugzilla.redhat.com/show_bug.cgi?id=1506736
security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_0326.json
cve.org/CVERecord?id=CVE-2018-20102
mail-archive.com/[email protected]/msg32055.html
This page doesn't list everything
Left out here: 9 versions. The JSON record has them.