TI-2019-15875 Aliases CVE-2019-1003030 GHSA-r6mc-mrvr-23cr

Protection mechanism failure in Jenkins Pipeline: Groovy Plugin

CRITICAL 100Exploited in the wildCWE-693Published 2019-03-08 · Updated 2025-10-21

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-693.

Summary

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Why it matters now

Exploitation Active In CISA KEV since 2022-03-25CISA due date 2022-04-15

EPSS 0.97058 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial org.jenkins-ci.plugins.workflow:workflow-cps (Maven): 2.64Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins Pipeline: Groovy Plugin	up to 2.63	—	No fix listed	CNA
—	org.jenkins-ci.plugins.workflow:workflow-cps (Maven)	before 2.64	2.64	Patch available	GHSA-r6mc-mrvr-23cr

Jenkins Pipeline: Groovy Plugin VendorJenkins Affected up to 2.63 Fixed in — No fix listed CNA
org.jenkins-ci.plugins.workflow:workflow-cps (Maven) Vendor— Affected before 2.64 Fixed in 2.64 Patch available GHSA-r6mc-mrvr-23cr

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:pipeline\:_groovy::::::jenkins::*	_groovy	Vulnerable	Jenkins
cpe:2.3:a:redhat:openshift_container_platform:3.11:::::::*	3.11	Vulnerable	Red Hat

cpe:2.3:a:jenkins:pipeline\:_groovy:*:*:*:*:*:jenkins:*:* Versions _groovy Vulnerable ·Jenkins
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat

Remediation

Fix · GHSA-r6mc-mrvr-23cr org.jenkins-ci.plugins.workflow:workflow-cps (Maven) Fixed in 2.64 Advisory →

Red Hat 1 advisory

RHSA-2019:0739 Released 2019-04-10 · Red Hat rating Important
Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update
- Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins-3.11.1552336312-1.el7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Container Platform 3.10	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.4	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.5	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.6	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.7	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.9	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11	Fixed	RHSA-2019:0739

Not affected: 1 product

Red Hat OpenShift Container Platform 4

Timeline

2022-03-25 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2019-1003030
2026-10-03 Alias added: GHSA-r6mc-mrvr-23cr

References

Exploit 1

http://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html

Advisory 3

Other 3

TI-2019-15846 A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in… CVSS 3.1HIGH 8.8
TI-2019-15847 A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier… CVSS 3.1HIGH 8.8
TI-2023-11034 Cross-site scripting in Jenkins Pipeline: Build Step Plugin CVSS 3.1MEDIUM 5.4
TI-2019-15886 A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows… CVSS 3.1CRITICAL 9.8
TI-2022-21197 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin CVSS 3.1CRITICAL 9.9
TI-2022-08895 Protection mechanism failure in Jenkins Pipeline: Shared Groovy Libraries Plugin CVSS 3.1HIGH 8.8

See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences