Published: 22/01/2019 Updated: 25/10/2023

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 655

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and previous versions in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

Vulnerable Product	Search on Vulmon	Subscribe to Product
jenkins pipeline\\ _declarative
redhat openshift container platform 3.11

A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 133 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Convertergroovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on ...

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::HttpServer include Msf::Exploit::FileDropper def initi ...

Jenkins RCE Proof-of-Concept: SECURITY-1266 / CVE-2019-1003000 (Script Security), CVE-2019-1003001 (Pipeline: Groovy), CVE-2019-1003002 (Pipeline: Declarative)

PoC: Jenkins RCE SECURITY-1266 / CVE-2019-1003000 (Script Security), CVE-2019-1003001 (Pipeline: Groovy), CVE-2019-1003002 (Pipeline: Declarative) A proof of concept to allow users with Overall/Read permission and Job/Configure (and optional Job/Build) to bypass the sandbox protection and execute arbitrary code on the Jenkins master or node Update: An article by Orange Tsai

NVD-CWE-Other https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266 https://access.redhat.com/errata/RHBA-2019:0326 https://www.exploit-db.com/exploits/46572/http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html https://access.redhat.com/errata/RHBA-2019:0327 https://nvd.nist.gov https://github.com/adamyordan/cve-2019-1003000-jenkins-rce-poc https://www.exploit-db.com/exploits/46572 https://access.redhat.com/security/cve/cve-2019-1003002

CVE-2019-1003002

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect