critical 9.9

CVE-2019-1003030 kev in the critical feed json

Sandbox bypass in Jenkins Pipeline: Groovy Plugin

published 2019-03-08 7 y ago modified 2026-06-17 4 mo ago also GHSA-r6mc-mrvr-23cr , EUVD-2022-5117

cvss: 9.9; version 3.1, CNA
cisa kev: Exploited; added 2022-03-25
epss: 97.1%; EPSS 97.1% chance of exploitation in 30 days, percentile 99.8%
public exploits: 1; Exploit-DB, plus a Nuclei check

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 1 distros 1

maven org.jenkins-ci.plugins.workflow:workflow-cps 2.64

jenkins-2-plugins openshift 3.11 3.11.1552336312-1.el7

red hat advisories RHSA-2019:0739

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-1003030 updated 2025-11-21 cvss 8.8

jenkins-plugin-workflow-cps: Sandbox bypass in Pipeline: Groovy Plugin (SECURITY-1336(2))

Red Hat OpenShift Container Platform 3.4 jenkins-plugin-workflow-cps Red Hat OpenShift Container Platform 3.5 jenkins-plugin-workflow-cps Red Hat OpenShift Container Platform 3.6 jenkins-2-plugins Red Hat OpenShift Container Platform 3.7 jenkins-2-plugins Red Hat OpenShift Container Platform 3.9 jenkins-2-plugins Red Hat OpenShift Container Platform 3.10 jenkins-2-plugins
affected: no fix planned “Will not fix”
Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins 3.11.1552336312-1.el7
fixed: vendor fix RHSA-2019:0739
Red Hat OpenShift Container Platform 4 jenkins-2-plugins
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2019-03-08 Published
2020-10-19 First public exploit (EDB-48904)
2022-03-25 Added to CISA KEV
2022-04-15 CISA patch deadline
2025-02-07 CISA SSVC: exploitation active

Known exploited

Added: 4 y ago (2022-03-25)
Patch by: 2022-04-15 (4 y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Jenkins, Matrix Project Plugin
CISA name: Jenkins Matrix Project Plugin Remote Code Execution Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 21 mo ago (2025-02-07)

Exploit prediction

97.06% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-48904 Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in webapps, 2020-10-19
Nuclei template Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization nuclei detection template
packetstormsecurity.com http://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA	3.1	9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P
GitHub	3.1	9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.jenkins-ci.plugins.workflow:workflow-cps	<2.64	2.64

Affected products

Jenkins project Jenkins Pipeline: Groovy Plugin

Classification

Weakness

CWE-693 Protection Mechanism Failure

References

packetstormsecurity.com /files/159603/Jenkins-2.63-Sandbox-Bypass.html
web, exploit, third-party-advisory, vdb-entry
access.redhat.com /errata/RHSA-2019:0739
vendor-advisory, web, third-party-advisory
jenkins.io /security/advisory/2019-03-06/#SECURITY-1336%20%282%29
third-party-advisory
securityfocus.com /bid/107476
vdb-entry, broken-link, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003030
government-resource, web, us-government-resource
nvd.nist.gov /vuln/detail/CVE-2019-1003030
advisory
github.com /jenkinsci/workflow-cps-plugin
package
jenkins.io /security/advisory/2019-03-06/#SECURITY-1336%20(2)
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary