PT-2019-2579

CVE-2019-1003041

Published

2019-03-25

Updated

2023-10-25

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Groovy Plugin versions 2.64 and earlier

Description The issue is related to a sandbox bypass vulnerability in the Jenkins Pipeline: Groovy Plugin, which is associated with incorrect type conversion. This allows attackers to invoke arbitrary constructors in sandboxed scripts, potentially enabling remote attackers to execute malicious actions.

Recommendations For Jenkins Pipeline: Groovy Plugin versions 2.64 and earlier, update to a version later than 2.64 to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Anthony Weems

Vendors

Affected products

Weakness enumeration

CWE-704: Incorrect Type Conversion or Cast

CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\'Unsafe Reflection\')

Related identifiers