CVE-2019-1003006

2019-02-0616:00:00

jenkins

www.cve.org

jenkins

groovy

sandbox bypass

vulnerability

arbitrary code execution

http endpoint

EPSS

0.001

Percentile

43.1%

JSON

A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

CNA Affected

[
  {
    "product": "Jenkins Groovy Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "2.0 and earlier"
      }
    ]
  }
]

References

jenkins.io/security/advisory/2019-01-28/#SECURITY-1293

EPSS

0.001

Percentile

43.1%

JSON

Related for CVELIST:CVE-2019-1003006