Skip to content
Fencer Vulns
critical 9.9

CVE-2019-10328 json

Unsafe entry in Script Security list of approved signatures in Pipeline Remote Loader Plugin

published 2019-05-31 7 y ago modified 2026-06-17 4 mo ago also GHSA-v558-fhw2-v46w , EUVD-2022-5283

cvss
9.9
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 80%
public exploits
0
none known

Summary

Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.

Patch / fix

  • maven org.jenkins-ci.plugins:workflow-remote-loader 1.5
  • jenkins-2-plugins openshift 4.1 4.1.1561471763-1.el7
  • jenkins-2-plugins openshift 4.2 4.2.1568997376-1.el7
  • cri-o openshift 3.11 1.11.14-1.rhaos3.11.gitd56660e.el7
  • jenkins openshift 3.11 2.164.2.1555422716-1.el7
  • prometheus openshift 3.11 3.11.117-1.git.1.f52d417.el7
  • jenkins-2-plugins openshift 3.11 3.11.1559667994-1.el7
  • openshift-ansible openshift 3.11 3.11.123-1.git.0.db681ba.el7
  • openshift-ansible-test openshift 3.11 3.11.123-1.git.0.db681ba.el7

red hat advisories RHSA-2019:1636RHBA-2019:2921RHBA-2019:1605

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-10328 updated cvss 8.8

jenkins-plugin-workflow-remote-loader: Unsafe Script Security whitelist entry in Pipeline Remote Loader Plugin (SECURITY-921)

  • Red Hat OpenShift Container Platform 3.6 jenkins-plugin-workflow-remote-loader Red Hat OpenShift Container Platform 3.7 jenkins-plugin-workflow-remote-loader Red Hat OpenShift Container Platform 3.9 jenkins-plugin-workflow-remote-loader Red Hat OpenShift Container Platform 3.10 jenkins-plugin-workflow-remote-loader
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 jenkins 2.164.2.1555422716-1.el7, jenkins-2-plugins 3.11.1559667994-1.el7, prometheus 3.11.117-1.git.1.f52d417.el7, cri-o 1.11.14-1.rhaos3.11.gitd56660e.el7, openshift-ansible 3.11.123-1.git.0.db681ba.el7, openshift-ansible-test 3.11.123-1.git.0.db681ba.el7, +19 more
    fixed: vendor fix RHBA-2019:1605
  • Red Hat OpenShift Container Platform 4.1 jenkins-2-plugins 4.1.1561471763-1.el7
    fixed: vendor fix RHSA-2019:1636
  • Red Hat OpenShift Container Platform 4.2 jenkins-2-plugins 4.2.1568997376-1.el7
    fixed: vendor fix RHBA-2019:2921
  • Red Hat OpenShift Container Platform 4.2 jq 1.6-2.el7, apb 2.0.3-1.el7, faq 0.0.6-3.el7, fb303 0.9.1-15.el7, podman 1.4.2-5.el8, kibana 5.6.16-2.el7, +138 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.94% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
GitHub 3.0 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.jenkins-ci.plugins:workflow-remote-loader
<1.5
1.5

Affected products

  • Jenkins project Jenkins Pipeline Remote Loader Plugin

Classification

Weakness
  • CWE-693 Protection Mechanism Failure
  • CWE-183 Permissive List of Allowed Inputs

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.