WaratekVRT Sign in

CVE-2019-1003029 Jenkins Script Security

Affected softwareJenkins Script Security
Severity9.9 Critical CVSS 3.1 3 scores
Fixed in1.54
WeaknessCWE-693
Published8 Mar 2019
Updated29 Sep 2026

Description

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-04-25 · remediation due 2022-05-16 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 2 citations · earliest 2021-10-13.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
  • Indexed PoC 1 indexed Published artifacts you can open, in Metasploit.
  • EPSS 74% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.5% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2019-1003029 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation lacework.com /blog/spytech-necro-keksecs-latest-python-malware 2021-10-13
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-04-25
IndexArtifactStarsFirst seen
Metasploit Jenkins ACL Bypass and Metaprogramming RCE (excellent rank)

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Process rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: ARMR Process rule

Jenkins Script Security sandbox bypass: a crafted class sent to checkScript runs its constructor outside the sandbox. The Process rule (with /bin/* and /usr/* listed) blocks the execute()/Runtime.exec command every public exploit runs. A script that reads files or data inside Jenkins, without starting a program, is not stopped.

Hardening: a filesystem write rule on the Jenkins user's ~/.groovy/grapes also stops Metasploit's Java Dropper, which downloads a JAR with @Grab and runs it inside Jenkins without starting a program (that target goes through the Pipeline checkScriptCompile endpoint, not this CVE's).

How to mitigate CVE-2019-1003029

Upgrade Jenkins Script Security to 1.54 or later. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.9 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 6.5 none AV:N/AC:L/Au:S/C:P/I:P/A:P NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.jenkins-ci.plugins:script-security 0 1.54 unbounded

Products and versions

3 products, 3 version entries
SourceVendorProductSchemeAffected versions
nvd jenkins script security generic ≤ 1.53
osv org.jenkins-ci.plugins script-security generic ＜ 1.54
nvd redhat openshift container platform generic 3.11

References

URLTags
https://access.redhat.com/errata/RHSA-2019:0739 WEB
https://github.com/jenkinsci/script-security-plugin PACKAGE
https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29 WEB
https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(1) WEB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003029 WEB
http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html WEB
http://www.securityfocus.com/bid/107476 Broken Link, Third Party Advisory, VDB Entry

Timeline
Published2019-03-08By the CVE Program.
VulnCheck KEV: earliest evidence2021-10-13Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-04-25Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2022-04-25Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Last VRT activity2026-09-29Most recent commit touching this CVE's classification, patch or rule file.
Classification created2026-11-13First commit adding this CVE's research note.