CVE-2019-1003041
CVE-2019-1003041 is a critical-severity vulnerability in Jenkins Pipeline with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-470.
Key facts
- Severity: Critical (CVSS 3.x base score 9.8)
- CVSS v2: 7.5
- EPSS exploit prediction: 3% (87th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-470
- Affected product: Jenkins Pipeline
- Published:
- Last modified:
Description
A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
Frequently asked questions
- What is CVE-2019-1003041?
- A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
- How severe is CVE-2019-1003041?
- CVE-2019-1003041 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2019-1003041 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (87th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2019-1003041?
- CVE-2019-1003041 primarily affects Jenkins Pipeline. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2019-1003041?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2019-1003041 published?
- CVE-2019-1003041 was published on 2019-03-28 and last updated on 2026-06-17.
References
- http://www.openwall.com/lists/oss-security/2019/03/28/2
- http://www.securityfocus.com/bid/107628
- https://access.redhat.com/errata/RHSA-2019:1423
- https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1353
Affected products (2)
- cpe:2.3:a:jenkins:pipeline\:_groovy:*:*:*:*:*:jenkins:*:*
- cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
Other CWE-470 (Unsafe Reflection) vulnerabilities
- CVE-2026-42027 — Critical (CVSS 9.8): Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before…
- CVE-2025-34393 — Critical (CVSS 9.8): Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify…
- CVE-2025-53693 — Critical (CVSS 9.8): Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore…
- CVE-2023-6943 — Critical (CVSS 9.8): Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric…
- CVE-2021-31522 — Critical (CVSS 9.8): Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version…
- CVE-2019-1003040 — Critical (CVSS 9.8): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary…