{"id":"CVE-2019-1003002","published":"2019-01-22T14:00:00Z","modified":"2024-08-05T03:00:19Z","title":"A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in…","vendor":"Jenkins project","product":"Pipeline: Declarative Plugin","tier":"core","eol":null,"affectedVersions":[{"vendor":"Jenkins project","product":"Pipeline: Declarative Plugin","versions":["1.3.3 and earlier"]}],"description":{"text":"A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Pipeline: Declarative Plugin for Jenkins, version 1.3.3 and earlier, contains a sandbox bypass flaw in its Converter.groovy component within the pipeline-model-definition module. An attacker holding only Overall/Read permission can submit a crafted pipeline script to an HTTP endpoint, which can lead to arbitrary code execution on the Jenkins master JVM.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:18:51Z"},"cvss":null,"epss":{"score":0.81362,"percentile":0.99635,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0326","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html","tags":["x_refsource_MISC"]},{"url":"http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming","tags":["x_refsource_MISC"]},{"url":"https://www.exploit-db.com/exploits/46572/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.jenkinsci.plugins:pipeline-model-definition","vulnerableRanges":["<1.3.4.1"],"patched":["1.3.4.1"],"from":["GHSA-x6jx-cxg3-mggh"],"provenance":"source"}],"advisories":[{"id":"GHSA-x6jx-cxg3-mggh","url":"https://github.com/advisories/GHSA-x6jx-cxg3-mggh","severity":"HIGH","ecosystem":"Maven","package":"org.jenkinsci.plugins:pipeline-model-definition","vulnerableRanges":["<1.3.4.1"],"patched":["1.3.4.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-5729","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5729","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":46427,"url":"https://www.exploit-db.com/exploits/46427","title":"Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)","type":"webapps","platform":"java","date":"2019-02-19","verified":true,"provenance":"source"},{"id":46572,"url":"https://www.exploit-db.com/exploits/46572","title":"Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)","type":"remote","platform":"java","date":"2019-03-19","verified":true,"provenance":"source"},{"id":46572,"url":"https://www.exploit-db.com/exploits/46572","title":"Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)","type":"remote","platform":"java","date":"2019-03-19","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2019-02-19"},"metasploit":[{"name":"Jenkins ACL Bypass and Metaprogramming RCE","module":"exploit/multi/http/jenkins_metaprogramming","type":"exploit","disclosureDate":"2019-01-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_metaprogramming.rb"}],"first":{"date":"2019-01-08","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_metaprogramming.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/46572/","http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html","https://www.exploit-db.com/exploits/46572"],"flow":[],"timeline":[{"date":"2019-01-08","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2019-02-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_metaprogramming.rb","provenance":"source"},{"date":"2019-01-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-1003002","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9963"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 3 Exploit-DB entries; 1 NVD exploit link; 1 advisory exploit reference; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}