1name: crowdsecurity/vpatch-CVE-2019-1003030
2description: "Jenkins - RCE (CVE-2019-1003030)"
3rules:
4  - and:
5      - zones:
6          - URI
7        transform:
8         - lowercase
9        match:
10          type: endsWith
11          value: descriptorbyname/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.securegroovyscript/checkscript
12labels:
13  type: exploit
14  service: http
15  confidence: 3
16  spoofable: 0
17  behavior: "http:exploit"
18  references:
19    - https://www.exploit-db.com/exploits/48904
20  label: "Jenkins - RCE"
21  classification:
22    - cve.CVE-2019-1003030
23    - attack.T1595
24    - attack.T1190
25    - cwe.CWE-264
26