WaratekVRT Sign in

CVE-2019-1003000 jenkins Script Security

Affected softwarejenkins Script Security
Severity8.8 High CVSS 3.1 2 scores
Fixed in1.50
WeaknessCWE-693
Published22 Jan 2019
Updated17 Jun 2026

Description

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 1 citation · honeypot sightings · 3 exploits · earliest 2020-01-31.
  • CISA Vulnrichment no assessment published
  • Indexed PoC 11 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2017-04-26.
  • EPSS 98% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2019-1003000 in VulnCheck (free account).

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 1 day 2026-09-16
Reported exploitation f5.com /labs/articles/threat-intelligence/vulnerabilities--exploits--and-malware-driving-attack-campaigns-in-december-2019 2020-01-31
Exploit reference VulnCheck XDB de51fcf4903b Exploit type: remote-with-credentials 2019-02-15
Exploit reference VulnCheck XDB fe839f485e5a Exploit type: initial-access 2019-03-06
Exploit reference VulnCheck XDB c796372de90d Exploit type: initial-access 2019-04-24

2 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Jenkins RCE Proof-of-Concept: SECURITY-1266 / CVE-2019-1003000 (Script Security), CVE-2019-1003001 (Pipeline: Groovy), CVE-2019-1003002 (Pipeline: Declarative) 315 2019-02-15
Nuclei Jenkins Script Security Plugin <=1.49 - Sandbox Bypass
Exploit-DB Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit) 2019-03-19
Metasploit Jenkins ACL Bypass and Metaprogramming RCE (excellent rank)
GitHub PoC CVE-2020-8012, CVE-2016-10709, CVE-2017-17099, CVE-2017-18047, CVE-2019-1003000, CVE-2018-1999002 83 2017-04-26
Exploit-DB Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit) 2019-03-19
GitHub PoC A C# module to detect if a Jenkins server is vulnerable to the RCE vulnerability found in CVE-2019-1003000 (chained with CVE-2018-1000861 for pre-auth RCE) 4 2019-04-24
Exploit-DB Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution 2019-02-25
GitHub PoC purple-WL/Jenkins_CVE-2019-1003000 1 2022-02-12
Exploit-DB Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC) 2019-02-19

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action unverified
  • Review automated Inferred
  • Record active
Decided by The affected package being open source on Maven, so the fix can be read
Finding This CVE affects an open-source Java library published on Maven Central (Maven packages: org.jenkins-ci.plugins:script-security), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on.

CVSS

8.8 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 6.5 none AV:N/AC:L/Au:S/C:P/I:P/A:P NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.jenkins-ci.plugins:script-security 0 1.50 unbounded

Products and versions

3 products, 3 version entries
SourceVendorProductSchemeAffected versions
nvd jenkins script security generic ≤ 1.49
osv org.jenkins-ci.plugins script-security generic ＜ 1.50
nvd redhat openshift container platform generic 3.11

References

URLTags
https://github.com/jenkinsci/script-security-plugin/commit/2c5122e50742dd16492f9424992deb21cc07837c WEB
https://access.redhat.com/errata/RHBA-2019:0326 WEB
https://access.redhat.com/errata/RHBA-2019:0327 WEB
https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266 WEB
https://www.exploit-db.com/exploits/46453 WEB
https://www.exploit-db.com/exploits/46572 WEB
http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html WEB
http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming WEB
https://www.exploit-db.com/exploits/46453/ Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46572/ Exploit, Third Party Advisory, VDB Entry

Timeline
Published2019-01-22By the CVE Program.
VulnCheck KEV: earliest evidence2020-01-31Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-09-16Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.