CVE-2018-6356

moderate-risk
Published 2018-02-20

Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files. This allowed users with Overall/Read permission to download files from the Jenkins master they should not have access to. On Windows, any file accessible to the Jenkins master process could be downloaded. On other operating systems, any file within the Jenkins home directory accessible to the Jenkins master process could be downloaded.

Do I need to act?

!
37.8% chance of exploitation in next 30 days
EPSS score — higher than 62% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.5/10 Medium
NETWORK / LOW complexity

Affected Products (3)

Affected Vendors

Oracle Jenkins

References (8)

Mailing List http://www.openwall.com/lists/oss-security/2018/02/14/1
Broken Link http://www.securityfocus.com/bid/103037
Vendor Advisory https://jenkins.io/security/advisory/2018-02-14/
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
Mailing List http://www.openwall.com/lists/oss-security/2018/02/14/1
Broken Link http://www.securityfocus.com/bid/103037
Vendor Advisory https://jenkins.io/security/advisory/2018-02-14/
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
49
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 16/34 · Moderate
Exposure 9/34 · Low