Is CVE-2019-1003029 exploited in the wild?

Yes. CVE-2019-1003029 is known to be exploited in the wild, first recorded on 25 April 2022. Treat it as urgent.

How severe is CVE-2019-1003029?

Critical severity, with a CVSS score of 3.1, published 13 May 2022.

Which products and versions are affected?

org.jenkins-ci.plugins:script-security (Maven) ECOSYSTEM:introduced=0,fixed=1.54.

Is there a fix for CVE-2019-1003029?

Yes. org.jenkins-ci.plugins:script-security (Maven): upgrade to 1.54 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-1003029 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-1003029?

Check whether you run Jenkins Script Security Plugin or org.jenkins-ci.plugins:script-security (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-1003029: Sandbox bypass in Script Security Plugin

CVE-2019-1003029 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2022-05-13

A sandbox bypass vulnerability in the Jenkins Script Security Plugin allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. The flaw exists in the GroovySandbox.java and SecureGroovyScript.java components due to a protection mechanism failure.

Technologies: Jenkins Script Security Plugin, org.jenkins-ci.plugins:script-security (Maven). Vendors: Jenkins, Maven.

Quick answers

Is CVE-2019-1003029 exploited in the wild?: Yes. CVE-2019-1003029 is known to be exploited in the wild, first recorded on 25 April 2022. Treat it as urgent.
How severe is CVE-2019-1003029?: Critical severity, with a CVSS score of 3.1, published 13 May 2022.
Which products and versions are affected?: org.jenkins-ci.plugins:script-security (Maven) ECOSYSTEM:introduced=0,fixed=1.54.
Is there a fix for CVE-2019-1003029?: Yes. org.jenkins-ci.plugins:script-security (Maven): upgrade to 1.54 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-1003029 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-1003029?: Check whether you run Jenkins Script Security Plugin or org.jenkins-ci.plugins:script-security (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.jenkins-ci.plugins:script-security (Maven): upgrade to 1.54 or later

# set org.jenkins-ci.plugins:script-security to 1.54 in your pom.xml or build.gradle

Affected products

Jenkins Project Script Security Plugin 1.53 and earlier

Identifiers

CVE-2019-1003029
GHSA-xvxq-hq48-xphm

Timeline

2019-03-06: disclosed: Vendor advisory SECURITY-1336 published.
2022-04-25: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.
2022-04-25: advisory: NVD publication date.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.