ZeroDay Findings
Sign inSign up

Findings

CVE-2019-1003030

Jenkins Matrix Project Plugin Remote Code Execution Vulnerability

Published Mar 8, 2019 · updated Jun 16, 2026 · jenkins pipeline

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 8, 2019 · Catalog

    Detected

    A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

  2. Mar 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Required action

Apply updates per vendor instructions.

CISA due date Apr 15, 2022

Affected

  • cpe jenkins/pipeline_groovy
  • cpe redhat/openshift container platform3.11
  • vendor Jenkins Matrix Project Pluginversion unspecified

Sources

  • CISA KEVCVE-2019-1003030

    Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.

    cisa.gov
  • CVE.orgCVE-2019-1003030

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2019-1003030

    30-day exploitation probability 97.1%

    first.org
  • Exploit Database48904

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2019-1003030

    A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References