CVE-2019-1003031

CRITICAL

A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission...

Affects 2 products across 2 vendors.

CVSS 3.19.9
EPSS3.5%
Percentile89th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2019. A critical vulnerability affects Jenkins systems (CVE-2019-1003031). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2019-GLOBAL-211878-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2019-1003031?
This vulnerability was disclosed in 2019. A critical vulnerability affects Jenkins systems (CVE-2019-1003031). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2019-1003031?
CVE-2019-1003031 has CVSS 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS: 3.5%.
Is CVE-2019-1003031 actively exploited?
No confirmed active exploitation of CVE-2019-1003031 as of 2026-05-30.
How do I remediate CVE-2019-1003031?
Priority: MEDIUM. Advisory: https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1339 PSIRT: [email protected]
What systems are affected by CVE-2019-1003031?
CVE-2019-1003031 affects Jenkins Matrix Project; Redhat Openshift Container Platform.
Vulnerability Details
CVE IDCVE-2019-1003031
BSIDBS-2019-GLOBAL-211878-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published2019-03-08
Last Modified2024-11-21
ICS Relevance0%
Domains
CLOUD
SourceNVD
Official Description

A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Exploitation Likelihood: LOW

Affected Products
VendorProductAffected Versions
Jenkins Matrix Project ≤ 1.13
Redhat Openshift Container Platform 3.11
Remediation
View Vendor Advisory →

Remediation Priority: MEDIUM

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2778 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash32cd3bd02a0cf6ee301d47a6d6576191ef31b7b3e9c410716b4fa17003dbcd0faaf1649746df28b8ff05d8473637fda61bb21d28064cda0a07b2ba752e9f3fd2
Related CVEs affecting Jenkins
CVE-2019-10431 9.9 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and ear... CVE-2019-10418 9.9 Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom w... CVE-2020-2279 9.9 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and ear... CVE-2022-43401 9.9 A sandbox bypass vulnerability involving various casts performed implicitly b... CVE-2022-43402 9.9 A sandbox bypass vulnerability involving various casts performed implicitly b...
View all Jenkins CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →