CVE-2018-1999002

HIGH7.5EPSS 93.7%

Improper Input Validation in Jenkins

Published: 5/13/2022Modified: 2/19/2024

Description

A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.

Affected packages (1)

Maven/org.jenkins-ci.main:jenkins-corefrom 0, < 2.121.2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2018-1999002
PATCHhttps://github.com/jenkinsci/jenkins
WEBhttps://github.com/jenkinsci/jenkins/commit/29ca81dd59c255ad633f1bd86cf1be40a5f02c64
WEBhttps://github.com/jenkinsci/stapler/commit/8e9679b08c36a2f0cf2a81855d5e04e2ed2ac2b3
WEBhttps://jenkins.io/security/advisory/2018-07-18/#SECURITY-914
WEBhttps://www.exploit-db.com/exploits/46453
WEBhttps://www.oracle.com/security-alerts/cpuapr2022.html