CVE-2019-1003005

🗓️ 06 Feb 2019 16:00:00Reported by jenkinsType

cve🔗 web.nvd.nist.gov👁 108 Views🌐 WEB

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.50 allows arbitrary code execution

Reporter	Title	Published	Views	Family All 18
GithubExploit	Exploit for Deserialization of Untrusted Data in Jenkins	8 May 201913:52	–	githubexploit
Circl	CVE-2019-1003005	18 Mar 201912:37	–	circl
Cvelist	CVE-2019-1003005	6 Feb 201916:00	–	cvelist
Github Security Blog	Sandbox Bypass in Script Security Plugin	13 May 202201:00	–	github
Hacker One	Django: Jenkins Unauthenticated RCE on https://djangoci.com/	14 May 201907:48	–	hackerone
canvas	Immunity Canvas: JENKINS_CHECKSCRIPT_RCE	8 Mar 201921:29	–	canvas
Metasploit	Jenkins ACL Bypass and Metaprogramming RCE	16 Mar 201905:32	–	metasploit
NVD	CVE-2019-1003005	6 Feb 201916:29	–	nvd
OSV	GHSA-X5JM-RJ37-5QH7 Sandbox Bypass in Script Security Plugin	13 May 202201:00	–	osv
OSV	RHSA-2019:0739 Red Hat Security Advisory: Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update	16 Sep 202402:22	–	osv

NVD

Node

jenkins script_securityRange≤1.50jenkins

[
  {
    "product": "Jenkins Script Security Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "1.50 and earlier"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html
access	www.access.redhat.com/errata/RHSA-2019:0739
jenkins	www.jenkins.io/security/advisory/2019-01-28/

Parameter	Position	Path	Description	CWE
value	path	securityRealm/user/admin/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript	ACL bypass enabled by vulnerable Script Security plugin endpoint used to checkScript during Groovy sandbox bypass	CWE-306
sandbox	path	securityRealm/user/admin/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript	ACL bypass enabled by vulnerable Script Security plugin endpoint used to checkScript during Groovy sandbox bypass	CWE-306
value	path	securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile	RCE via checkScriptCompile for Pipeline: Groovy by bypassing ACLs	CWE-306
sandbox	path	securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile	RCE via checkScriptCompile for Pipeline: Groovy by bypassing ACLs	CWE-306

21 Nov 2024 04:17Current

8.8High risk

Vulners AI Score8.8

CVSS 26.5

CVSS 3.18.8

EPSS0.74186