CVE-2019-1003006

2019-02-0616:29:00

Google

osv.dev

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.1%

JSON

A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

CPENameOperatorVersion
groovy-plugineqgroovy-1.12
groovy-plugineqgroovy-1.14
groovy-plugineqgroovy-1.10
groovy-plugineqgroovy-2.0
groovy-plugineqgroovy-1.8
groovy-plugineqgroovy-1.25
groovy-plugineqgroovy-1.28
groovy-plugineqgroovy-1.9
groovy-plugineqgroovy-1.15
groovy-plugineqgroovy-1.24

Name	Operator	Version
groovy-plugin	eq	groovy-1.12
groovy-plugin	eq	groovy-1.14
groovy-plugin	eq	groovy-1.10
groovy-plugin	eq	groovy-2.0
groovy-plugin	eq	groovy-1.8
groovy-plugin	eq	groovy-1.25
groovy-plugin	eq	groovy-1.28
groovy-plugin	eq	groovy-1.9
groovy-plugin	eq	groovy-1.15
groovy-plugin	eq	groovy-1.24