CVE-2019-1003033

2019-03-0821:29:00

Google

osv.dev

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.7%

JSON

A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

CPENameOperatorVersion
groovy-plugineqgroovy-1.12
groovy-plugineqgroovy-1.14
groovy-plugineqgroovy-1.10
groovy-plugineqgroovy-2.0
groovy-plugineqgroovy-1.8
groovy-plugineqgroovy-1.25
groovy-plugineqgroovy-1.28
groovy-plugineqgroovy-1.9
groovy-plugineqgroovy-1.15
groovy-plugineqgroovy-1.24

Name	Operator	Version
groovy-plugin	eq	groovy-1.12
groovy-plugin	eq	groovy-1.14
groovy-plugin	eq	groovy-1.10
groovy-plugin	eq	groovy-2.0
groovy-plugin	eq	groovy-1.8
groovy-plugin	eq	groovy-1.25
groovy-plugin	eq	groovy-1.28
groovy-plugin	eq	groovy-1.9
groovy-plugin	eq	groovy-1.15
groovy-plugin	eq	groovy-1.24