Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2019-1003030: Jenkins Matrix Project plugin may let attackers run code
CVE-2019-1003030 · published 7 years ago · actively exploited
Summary
The Matrix Project plugin for Jenkins, as well as related workflow and pipeline components, contains a flaw that could let a malicious user break out of its safety limits and execute commands on the server. This could give an attacker control over the Jenkins host and any systems it can reach. Apply the latest updates for the Matrix Project plugin and related Jenkins components, or disable the plugin until it is patched.
What to do
- Update jenkins-ci org.jenkins-ci.plugins.workflow:workflow-cps to version 2.64.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | jenkins | matrix project plugin | All versions |
| maven | jenkins-ci | org.jenkins-ci.plugins.workflow:workflow-cps |
< 2.64 Fix: upgrade to 2.64
|
| – | jenkins | pipeline\ |
_groovy cpe:2.3:a:jenkins:pipeline\:_groovy:*:*:*:*:*:jenkins:*:* |
| – | redhat | openshift_container_platform |
3.11 cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* |
Original advisory text
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.
References
- http://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html Exploit
- https://nvd.nist.gov/vuln/detail/CVE-2019-1003030
- https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(2)
- https://github.com/advisories/GHSA-r6mc-mrvr-23cr
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-... URL
- http://www.securityfocus.com/bid/107476 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:0739 Vendor Advisory
- https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%282%29 Vendor Advisory
Internet-facing
3 days
and check for signs of compromise
Internal
14 days
- Known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.9
Critical
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
97%
chance of attack within 30 days
Type
CWE-693Protection Mechanism Failure
Timeline
Published8 Mar 2019
Updated20 Oct 2026
First seen6 Mar 2026
Sources
CVE-2019-1003030 · CISA KEV
CVE-2019-1003030 · NVD
GHSA-r6mc-mrvr-23cr · GHSA
CVE-2019-1003030 · OSV
Track software like this
Free during beta