Critical severity9.9NVD Advisory· Published Mar 8, 2019· Updated Jun 17, 2026

CVE-2019-1003031

Description

A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:matrix-projectMaven	< 1.14	1.14

Affected products

ghsa-coords
pkg:maven/org.jenkins-ci.plugins/matrix-project
Range: < 1.14
Jenkins Project/Matrix Project
cpe:2.3:a:jenkins:matrix_project:*:*:*:*:*:jenkins:*:*
Range: <=1.13
Red Hat/Openshift Container Platform
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
Jenkins Project/Matrix Project Plugincpe-rescue
Range: 1.13 and earlier

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/107476nvdThird Party AdvisoryVDB EntryWEB
access.redhat.com/errata/RHSA-2019:0739nvdThird Party AdvisoryWEB
github.com/advisories/GHSA-qxf8-8837-hq7wghsaADVISORY
jenkins.io/security/advisory/2019-03-06/nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2019-1003031ghsaADVISORY
github.com/jenkinsci/matrix-project-plugin/commit/765fc39694b31f8dd6e3d27cf51d1708b5df2be7ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.003
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000