Lucene search
PRIOn knowledge basePRION:CVE-2019-1003000HistoryJan 22, 2019 - 2:29 p.m.
Security feature bypass
2019-01-2214:29:00
PRIOn knowledge base
www.prio-n.com
11
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
| CPE | Name | Operator | Version |
|---|---|---|---|
| script_security | le | 1.49 | |
| openshift_container_platform | eq | 3.11 |
References
packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html
www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming
access.redhat.com/errata/RHBA-2019:0326
access.redhat.com/errata/RHBA-2019:0327
jenkins.io/security/advisory/2019-01-08/
www.exploit-db.com/exploits/46453/
www.exploit-db.com/exploits/46572/
Related
osv
osv
CVE-2019-1003000
2019-01-22 14:29:00
Protection Mechanism Failure in Jenkins Script Security Plugin
2022-05-13 01:15:19
redhatcve
redhatcve
CVE-2019-1003000
2019-01-25 14:19:19
CVE-2019-1003005
2020-04-09 10:33:39
cvelist
cvelist
CVE-2019-1003000
2019-01-22 14:00:00
cve
cve
CVE-2019-1003000
2019-01-22 14:29:00
checkpoint_advisories
checkpoint_advisories
Jenkins Multiple Plugins Remote Code Execution (CVE-2019-1003000)
2019-03-03 00:00:00
github
github
Protection Mechanism Failure in Jenkins Script Security Plugin
2022-05-13 01:15:19
veracode
veracode
Sandbox Restrictions Bypass
2019-05-16 03:24:06
nvd
nvd
CVE-2019-1003000
2019-01-22 14:29:00
metasploit
metasploit
Jenkins ACL Bypass and Metaprogramming RCE
2019-03-16 05:32:36
packetstorm
packetstorm
Jenkins Script Security 1.49 / Declarative 1.3.4 / Groovy 2.60 Remote Code Execution
2019-02-25 00:00:00
Jenkins ACL Bypass / Metaprogramming Remote Code Execution
2019-03-19 00:00:00
exploitpack
exploitpack
zdt
zdt
nessus
nessus
Jenkins Security Advisory 2019-01-08 Multiple Vulnerabilities
2019-09-24 00:00:00
exploitdb
exploitdb