PT-2018-9363 · Cloudbees+1 · Jenkins

Published 2018-06-05 · Updated 2022-06-13 · CVE-2018-1000194

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.121 Jenkins LTS versions prior to 2.107.3

Description A path traversal issue exists that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing security protections. This is due to vulnerabilities in FilePath.java and SoloFilePathFilter.java.

Recommendations For Jenkins versions prior to 2.121, update to version 2.121 or later. For Jenkins LTS versions prior to 2.107.3, update to version 2.107.3 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-1000194

GHSA-X646-M7X2-GCP7

Affected Products

Jenkins

References · 7

• https://osv.dev/vulnerability/CVE-2018-1000194 · Vendor Advisory
• https://jenkins.io/security/advisory/2018-05-09/#SECURITY-788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000194 · Security Note
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://osv.dev/vulnerability/GHSA-x646-m7x2-gcp7 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/5cf0a77d44310523b763698f67d645c1f2427f30 · Note