CVE-2019-1003033

Name of the Vulnerable Software and Affected Versions: Jenkins Groovy Plugin versions 2.1 and earlier

Description: A sandbox bypass issue exists that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. The issue is related to the src/main/java/hudson/plugins/groovy/StringScriptSource.java file.

Recommendations: For Jenkins Groovy Plugin versions 2.1 and earlier, update to version 2.2 or later, which uses Script Security APIs to apply sandbox protection. As a temporary workaround, consider restricting access to the Jenkins master JVM to minimize the risk of exploitation.