cve.bz

CVE-2019-1003029

9.9 criticalKEVEPSS 74%

Critical (9.9) in Jenkins Script Security Plugin. In CISA KEV since 2022-04-25. EPSS 74% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.plugins:script-security 1.54.

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

Severity

CVSS 3.1

9.9 critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS
74% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV
listed 2022-04-25, due 2022-05-16
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-xvxq-hq48-xphmMavenorg.jenkins-ci.plugins:script-security<1.541.54

References

Check your stackJSON