cve.bz

CVE-2019-1003030

9.9 criticalKEVEPSS 97%

Critical (9.9) in Jenkins Matrix Project Plugin. In CISA KEV since 2022-03-25. EPSS 97% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.plugins.workflow:workflow-cps 2.64.

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Severity

CVSS 3.1

9.9 critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS
97% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV
listed 2022-03-25, due 2022-04-15
CWE
CWE-693
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-r6mc-mrvr-23crMavenorg.jenkins-ci.plugins.workflow:workflow-cps<2.642.64

References

Check your stackJSON