Jenkins Matrix Project Plugin Remote Code Execution Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 8, 2019 · Catalog

   Detected

   A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

2. Mar 25, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Apr 15, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Affected

• cpe jenkins/pipeline_groovy
• cpe redhat/openshift container platform3.11
• vendor Jenkins Matrix Project Pluginversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2019-1003030

  Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.

  cisa.gov
• CVE.orgVulnerability recordCVE-2019-1003030

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2019-1003030

  30-day exploitation probability 97.1%

  first.org
• Exploit DatabasePublic exploit reference48904

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• NIST NVDVulnerability recordCVE-2019-1003030

  A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

  nvd.nist.gov
• Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Exploit · packetstormsecurity.com
• Broken Link · securityfocus.com
• Third Party Advisory · access.redhat.com
• Third Party Advisory · jenkins.io
• CISA note · nvd.nist.gov