Jenkins Groovy vulnerabilities

2 CVEs affecting Jenkins Groovy, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-1003033, published 2019-03-08.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-1003033, published 2019-03-08. High severity, CVSS 8.8. EPSS: 2.5% chance of exploitation in the next 30 days. A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read…
• CVE-2019-1003006, published 2019-02-06. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to…