#VU21570 Improper access control in Script Security

Published: 2020-03-18 | Updated: 2021-06-17

Vulnerability identifier: #VU21570

Vulnerability risk: High


CVE-ID: CVE-2019-1003000


Exploitation vector: Network

Exploit availability:

Vulnerable software:
Script Security
Web applications / Modules and components for CMS

Vendor: Jenkins


The vulnerability allows a remote attacker to bypass sandbox restrictions.

The vulnerability exists due to improper access restrictions in "src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java" when applying AST transforming annotations such as @Grab to source code elements. A remote authenticated attacker with Overall/Read permission, or able to control Jenkins file or sandboxed Pipeline shared library contents in SCM, can bypass the sandbox protection and execute arbitrary code on the Jenkins master.

Install updates from vendor's website.

Vulnerable software versions

Script Security: 1.0 - 1.49

Fixed software versions


External links

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

Latest bulletins with this vulnerability