PT-2018-9362 · Cloudbees+1 · Jenkins

Published 2018-06-05 · Updated 2022-06-13 · CVE-2018-1000193

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.121 Jenkins LTS versions prior to 2.107.3

Description A vulnerability exists that allows improper neutralization of control sequences. This issue is related to the HudsonPrivateSecurityRealm.java file, which permits users to sign up with user names containing control characters. As a result, these user names can appear identical to other users and cannot be deleted through the user interface.

Recommendations For Jenkins versions prior to 2.121, update to version 2.121 or newer. For Jenkins LTS versions prior to 2.107.3, update to version 2.107.3 or newer.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2018-1000193

GHSA-7592-93RM-6GPX

Affected Products

Jenkins

References · 7

• https://jenkins.io/security/advisory/2018-05-09/#SECURITY-786 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000193 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7592-93rm-6gpx · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000193 · Security Note
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/de7aaab441151fb1760855fec83681c6a8756a45 · Note