CVE-2019-1003030: critical vulnerability in Jenkins Pipeline: Groovy Plugin
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Jenkins Pipeline plugin had a sandbox protection that could be bypassed by attackers who control pipeline scripts, allowing them to run arbitrary code on the Jenkins server. This is critical because Jenkins servers often have access to sensitive systems and credentials.
A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin ≤2.63 allows attackers with pipeline script control to execute arbitrary code on the Jenkins master JVM by circumventing the Groovy sandbox restrictions. The vulnerability is exploitable when an attacker can influence pipeline definitions, potentially leading to complete compromise of the Jenkins instance and connected systems.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.