CVE-2019-1003030: Jenkins Matrix Project Plugin Remote Code Execution Vulnerability

EPSS trend

Probability

97.06%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+0.19 pp

From 96.87% on 21-09-2026

21-09-202621-10-2026

EPSS score

97.06%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 25-03-2022
Federal due date: 15-04-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2019-1003030

Public exploits

2 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databasejavaUnverified
Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in
Maturity: poc

References

8 links

jenkins.io/security/advisory/2019-03-06/X Refsource CONFIRMThird Party Advisory
www.securityfocus.com/bid/107476VDB EntryX Refsource BIDBroken LinkThird Party Advisory
access.redhat.com/errata/RHSA-2019:0739Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEB
packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.htmlX Refsource MISCExploitThird Party AdvisoryVDB EntryWEB
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003030Government ResourceUS Government ResourceWEB
nvd.nist.gov/vuln/detail/CVE-2019-1003030Advisory
github.com/jenkinsci/workflow-cps-pluginPACKAGE
jenkins.io/security/advisory/2019-03-06/WEB

Related vulnerabilities

CVE-2018-1070redhatopenshift_container_platform+10.86%8y ago12-06-2018 13:00routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which can cause an entire shard to be brought down. A malicious user can use this vulnerability to cause a Denial of Service attack for other users of the router shard.CVE-2018-1085redhatopenshift_container_platform+12.28%8y ago15-06-2018 13:00openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the values of ETCD_CLIENT_CERT_AUTH and ETCD_PEER_CLIENT_CERT_AUTH in etcd.conf result in etcd being configured to allow remote users to connect without any authentication if they can access the etcd server bound to the network on the master nodes. An attacker could use this flaw to read and modify all the data about the Openshift cluster in the etcd datastore, potentially adding another compute node, or bringing down the entire cluster.CVE-2018-11307chainguardeco-java-gradle-2.10+545.73%7y ago09-07-2019 15:37An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.CVE-2018-1002105chainguardkubeflow-pipelines+4786.98%7y ago05-12-2018 21:00In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.CVE-2018-14632ubuntugolang-github-evanphx-json-patch+222.23%8y ago06-09-2018 13:00An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before 3.7. An attacker can use this flaw to cause a denial of service attack on the Openshift master api service which provides cluster management.CVE-2018-14718chainguardeco-java-gradle-2.10+7712.68%7y ago02-01-2019 18:00FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.

All vulnerabilities inopenshift_container_platform

CVE-2019-1003030: Jenkins Matrix Project Plugin Remote Code Execution Vulnerability

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References