CVE-2018-1999002

high-risk
Published 2018-07-23

A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.

Do I need to act?

!
92.8% chance of exploitation in next 30 days
EPSS score — higher than 7% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
46453
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Oracle Jenkins

References (6)

Mitigation https://jenkins.io/security/advisory/2018-07-18/#SECURITY-914
Exploit https://www.exploit-db.com/exploits/46453/
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
Mitigation https://jenkins.io/security/advisory/2018-07-18/#SECURITY-914
Exploit https://www.exploit-db.com/exploits/46453/
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
53
/ 100
high-risk
Severity 26/34 · High
Exploitability 20/34 · Moderate
Exposure 7/34 · Low