CVE-2019-1003029

🗓️ 08 Mar 2019 21:00:00Reported by jenkinsType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 1046 Views🌐 WEB

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.53 allows arbitrary code execution

Reporter	Title	Published	Views	Family All 25
GithubExploit	Exploit for Deserialization of Untrusted Data in Jenkins	8 May 201913:52	–	githubexploit
ATTACKERKB	CVE-2019-1003029	8 Mar 201900:00	–	attackerkb
Circl	CVE-2019-1003029	18 Mar 201912:37	–	circl
CISA KEV Catalog	Jenkins Script Security Plugin Sandbox Bypass Vulnerability	25 Apr 202200:00	–	cisa_kev
Check Point Advisories	Jenkins Script Security Plugin Remote Code Execution (CVE-2019-1003029)	15 May 202200:00	–	checkpoint_advisories
Cvelist	CVE-2019-1003029	8 Mar 201921:00	–	cvelist
Github Security Blog	Sandbox bypass in Script Security Plugin	13 May 202201:00	–	github
Hacker One	Django: Jenkins Unauthenticated RCE on https://djangoci.com/	14 May 201907:48	–	hackerone
canvas	Immunity Canvas: JENKINS_CHECKSCRIPT_RCE	8 Mar 201921:29	–	canvas
Metasploit	Jenkins ACL Bypass and Metaprogramming RCE	16 Mar 201905:32	–	metasploit

NVD

Node

jenkins script_securityRange≤1.53jenkins

Node

redhat openshift_container_platformMatch3.11

[
  {
    "product": "Jenkins Script Security Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "1.53 and earlier"
      }
    ]
  }
]

Source	Link
jenkins	www.jenkins.io/security/advisory/2019-03-06/
access	www.access.redhat.com/errata/RHSA-2019:0739
packetstormsecurity	www.packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html
securityfocus	www.securityfocus.com/bid/107476
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description
q	query param	/search/index	Used in reconnaissance to detect Jenkins version and attempt ACL bypass
apiUrl	query param	/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword	Endpoint for creating credentials; leveraged with crafted parameters for traversal/bypass during exploitation
login	query param	/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword	Endpoint for creating credentials; leveraged with crafted parameters for traversal/bypass during exploitation
password	query param	/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword	Endpoint for creating credentials; leveraged with crafted parameters for traversal/bypass during exploitation
sandbox	query param	/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript	Check script execution in sandbox; used as part of Groovy metaprogramming RCE chain
value	query param	/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript	Check script execution in sandbox; used as part of Groovy metaprogramming RCE chain
value	query param	/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile	Check script compilation endpoint used in RCE chain

24 Oct 2025 14:49Current

9.6High risk

Vulners AI Score9.6

CVSS 26.5

CVSS 3.19.9

EPSS0.92647

SSVC

In Wild