CVE-2019-1003029

🗓️ 08 Mar 2019 21:00:00Reported by jenkinsType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 1067 Views🌐 WEB

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.53 allows arbitrary code execution

Reporter	Title	Published	Views	Family All 27
GithubExploit	Exploit for Deserialization of Untrusted Data in Jenkins	8 May 201913:52	–	githubexploit
ATTACKERKB	CVE-2019-1003029	8 Mar 201900:00	–	attackerkb
BDU FSTEC	The vulnerabilities of the components GroovySandbox.java and SecureGroovyScript.java of the Jenkins Script Security plugin allow a perpetrator to execute arbitrary code.	14 Jun 201900:00	–	bdu_fstec
Circl	CVE-2019-1003029	18 Mar 201912:37	–	circl
CISA KEV Catalog	Jenkins Script Security Plugin Sandbox Bypass Vulnerability	25 Apr 202200:00	–	cisa_kev
Check Point Advisories	Jenkins Script Security Plugin Remote Code Execution (CVE-2019-1003029)	15 May 202200:00	–	checkpoint_advisories
Cvelist	CVE-2019-1003029	8 Mar 201921:00	–	cvelist
Github Security Blog	Sandbox bypass in Script Security Plugin	13 May 202201:00	–	github
Hacker One	Django: Jenkins Unauthenticated RCE on https://djangoci.com/	14 May 201907:48	–	hackerone
canvas	Immunity Canvas: JENKINS_CHECKSCRIPT_RCE	8 Mar 201921:29	–	canvas

NVD

Node

jenkins script_securityRange≤1.53jenkins

Node

redhat openshift_container_platformMatch3.11

[
  {
    "product": "Jenkins Script Security Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "1.53 and earlier"
      }
    ]
  }
]

Source	Link
jenkins	www.jenkins.io/security/advisory/2019-03-06/
access	www.access.redhat.com/errata/RHSA-2019:0739
packetstormsecurity	www.packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html
securityfocus	www.securityfocus.com/bid/107476
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description
apiUrl	query param	securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword	ACL bypass via dynamic routing leading to remote code execution (CVE-2019-1003029 context)
login	query param	securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword	ACL bypass via dynamic routing leading to remote code execution (CVE-2019-1003029 context)
password	query param	securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword	ACL bypass via dynamic routing leading to remote code execution (CVE-2019-1003029 context)
value	query param	securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile	CheckScriptCompile endpoint used in exploitation to trigger Groovy-based RCE (Java Dropper path)
value	query param	securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript	CheckScript endpoint used in exploitation to trigger Groovy sandbox bypass and RCE (Unix In-Memory path)

17 Jun 2026 02:09Current

9.6High risk

Vulners AI Score9.6

CVSS 26.5

CVSS 3.19.9

EPSS0.73854

SSVC

In Wild