{"id":"CVE-2019-1003002","aliases":["EUVD-2022-5729","GHSA-x6jx-cxg3-mggh","RHBA-2019:0326"],"status":"published","title":"Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability","description":"A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.81098,"percentile":0.99637,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2019-01-22T14:00:00Z","modified":"2026-10-24T10:30:48Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/jenkins_metaprogramming","title":"Jenkins ACL Bypass and Metaprogramming RCE","type":"exploit","platform":"Java,Unix","date":"2019-01-08","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming"},{"source":"exploitdb","id":"EDB-46427","title":"Jenkins Plugin Script Security \u003c 1.50/Declarative \u003c 1.3.4.1/Groovy \u003c 2.61.1 - Remote Code Execution (PoC)","type":"webapps","platform":"java","date":"2019-02-19","verified":true,"url":"https://www.exploit-db.com/exploits/46427"},{"source":"exploitdb","id":"EDB-46572","title":"Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)","type":"remote","platform":"java","date":"2019-03-19","verified":true,"url":"https://www.exploit-db.com/exploits/46572"}],"fixes":[{"ecosystem":"Maven","package":"org.jenkinsci.plugins:pipeline-model-definition","fixed_in":["1.3.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkinsci.plugins:pipeline-model-definition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.3"},{"fixed":"1.3.4.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkinsci.plugins:pipeline-model-definition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4.1"}]}],"versions":["0.1","0.2","0.3","0.4","0.5","0.6","0.7","0.7.1","0.8","0.8.1","0.8.2","0.9","0.9.1","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2","1.2-beta-2","1.2-beta-3","1.2-beta-4","1.2-beta-5","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3","1.3.1","1.3.2","1.3.3","1.3.3.1","1.3.4"]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-enterprise-service-catalog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.11.82-1.git.1673.133961e.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-enterprise-service-catalog-svcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.11.82-1.git.1673.133961e.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-cluster-autoscaler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.efb6af0.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-descheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.300.89765c9.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-dockerregistry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.452.0ce6383.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hypershift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-metrics-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.52.2fdca3f.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node-problem-detector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.254.a448936.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-service-idler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.14.e353758.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-web-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.355.5e8b1d9.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-openshift-oauth-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.425.7cac034.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.3bf41ce.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.1063.48444e8.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.5027.9d24833.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.17-3.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.17-3.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.17-3.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.150.2.1549032159-1.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.1549642489-1.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-playbooks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-roles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-enterprise-autoheal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.219.0b5aff4.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-enterprise-cluster-capacity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.380.cf11c51.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.5027.9d24833.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.3bf41ce.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus-node-exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.1063.48444e8.el7"}]}],"bundled":16}],"products":[{"vendor":"jenkins","product":"pipeline\\"},{"vendor":"jenkins project","product":"pipeline: declarative plugin"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0326","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.exploit-db.com/exploits/46572/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003002","tags":["advisory"]},{"url":"https://github.com/jenkinsci/pipeline-model-definition-plugin/commit/083abd96e68fd89f556a0cd53db5f878dbf09b92","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x6jx-cxg3-mggh"},{"url":"https://www.exploit-db.com/exploits/46572","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1506736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1598822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1615719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1623338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1634302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1642379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1642929","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1651090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1651632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1655183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1657019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659653","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659976","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1660598","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1664753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667618","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668412","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669984","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1673178","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_0326.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1658874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20102","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20102","tags":["advisory"]},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg32055.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20103","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1658876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20103","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20103","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1663060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20615","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1647059","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000865","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000866","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3826","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1672865","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3826","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667566","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003000","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-08/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669505","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003001","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669508","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003002","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668345","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003003","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-16/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003004","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003004","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670292","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003010","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003010","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1095","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670296","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003011","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003011","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670298","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003012","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1201","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003013","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670299","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003013","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003013","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1204","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003014","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1671324","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003014","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1253","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2019-1003002","description":"A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.","status":"published","published":"2019-01-22T14:00:00Z","modified":"2024-08-05T03:00:19.322Z","updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2022-5729","description":"A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.","status":"published","published":"2019-01-22T14:00:00Z","modified":"2024-08-05T03:00:19Z","updated_at":"2026-11-03T02:40:19.824838Z"}],"ghsa":[{"id":"GHSA-x6jx-cxg3-mggh","title":"Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability","description":"Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as `@Grab` to source code elements.\n\nBoth the pipeline validation REST APIs and actual script/pipeline execution are affected.\n\nThis allowed users with Overall/Read permission, or able to control Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to bypass the sandbox protection and execute arbitrary code on the Jenkins controller.\n\nAll known unsafe AST transformations in Groovy are now prohibited in sandboxed scripts.","status":"published","published":"2022-05-13T01:15:20Z","modified":"2023-12-18T09:19:42Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:37:26.727664Z"}],"nvd":[{"id":"CVE-2019-1003002","description":"A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.","status":"published","published":"2019-01-22T14:29:00.39Z","modified":"2026-06-17T02:09:31.113Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:02.989216Z"}],"osv":[{"id":"CVE-2019-1003002","description":"A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.","status":"published","published":"2019-01-22T14:29:00.39Z","modified":"2026-10-24T10:30:48.760636339Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"GHSA-x6jx-cxg3-mggh","title":"Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability","description":"Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as `@Grab` to source code elements.\n\nBoth the pipeline validation REST APIs and actual script/pipeline execution are affected.\n\nThis allowed users with Overall/Read permission, or able to control Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to bypass the sandbox protection and execute arbitrary code on the Jenkins controller.\n\nAll known unsafe AST transformations in Groovy are now prohibited in sandboxed scripts.","status":"published","published":"2022-05-13T01:15:20Z","modified":"2024-12-05T05:39:58.213546Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"RHBA-2019:0326","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update","status":"published","published":"2024-09-16T02:09:18Z","modified":"2026-08-05T10:05:51Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.117212Z"}]}}