CVE-2019-1003031 Script security sandbox bypass in Matrix Project Plugin

What is CVE-2019-1003031?

CVE-2019-1003031 is a critical code injection vulnerability in Redhat Openshift Container Platform, published on 8 Mar 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

Which versions are affected by CVE-2019-1003031?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:matrix-project. It affects 2 products.

Products include Jenkins Matrix Project, Redhat Openshift Container Platform.

How do I fix CVE-2019-1003031?

Upgrade org.jenkins-ci.plugins:matrix-project to 1.14 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2019-1003031 being exploited?

There is no known exploitation of CVE-2019-1003031 in the wild and no public exploit code.

Other vulnerabilities in Redhat Openshift Container Platform

• CVE-2022-20615 Stored XSS vulnerability in Matrix Project Plugin Medium 5.4
• CVE-2020-2224 Stored XSS vulnerability in single axis builds tooltips in Jenkins Matrix Project Plugin Medium 5.4
• CVE-2020-2225 Stored XSS vulnerability in multiple axis builds tooltips in Jenkins Matrix Project Plugin Medium 5.4
• CVE-2024-23900 Path traversal vulnerability in Jenkins Matrix Project Plugin Medium 4.3

All Redhat Openshift Container Platform vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qxf8-8837-hq7w.