← Back to CVEs

CVE-2018-1999002

HIGH

7.5

Description

A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published7/23/2018

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

jenkins:jenkinsoracle:communications_cloud_native_core_automated_test_suite

References

https://jenkins.io/security/advisory/2018-07-18/#SECURITY-914(cve@mitre.org)

https://www.exploit-db.com/exploits/46453/(cve@mitre.org)

https://www.oracle.com/security-alerts/cpuapr2022.html(cve@mitre.org)

https://jenkins.io/security/advisory/2018-07-18/#SECURITY-914(af854a3a-2127-422b-91ae-364da2661108)

https://www.exploit-db.com/exploits/46453/(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpuapr2022.html(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.