PT-2018-15186 · Cloudbees+1 · Jenkins

Published 2018-07-23 · Updated 2022-06-13 · CVE-2018-1999001

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.132 and earlier Jenkins versions 2.121.1 and earlier

Description A vulnerability exists that allows unauthorized modification of configuration, enabling attackers to provide crafted login credentials. This can cause Jenkins to move the config.xml file from the Jenkins home directory. If Jenkins starts without this file, it reverts to legacy defaults, granting administrator access to anonymous users.

Recommendations For Jenkins versions 2.132 and earlier, update to a version later than 2.132 to resolve the issue. For Jenkins versions 2.121.1 and earlier, update to a version later than 2.121.1 to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-1999001

GHSA-J8QV-MJ4R-6FW4

Affected Products

Jenkins

References · 7

• https://osv.dev/vulnerability/CVE-2018-1999001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999001 · Security Note
• https://jenkins.io/security/advisory/2018-07-18/#SECURITY-897 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://osv.dev/vulnerability/GHSA-j8qv-mj4r-6fw4 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/5f4d014b3b7f89e206c6c8509540ed559f604959 · Note