HIGH
jenkins: Flaw in the Stapler web framework allows remote unauthenticated users to read arbitrary files
Published Jul 23, 2018
7.5
HIGHCVSS 3.1
EPSS 86.46%
Description
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
Affected products
No data.
No data.
Red Hat OpenShift Enterprise 3
jenkins
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat OpenShift Enterprise 3 | jenkins | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (10)
- https://access.redhat.com/security/cve/CVE-2018-1999002 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1609613 Issue Tracking
- https://github.com/advisories/GHSA-qf38-f2fr-q4x9 Advisory
- https://github.com/jenkinsci/jenkins/commit/29ca81dd59c255ad633f1bd86cf1be40a5f02c64
- https://github.com/jenkinsci/stapler/commit/8e9679b08c36a2f0cf2a81855d5e04e2ed2ac2b3
- https://jenkins.io/security/advisory/2018-07-18/#SECURITY-914 x_refsource_CONFIRMMitigationVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-1999002
- https://www.cve.org/CVERecord?id=CVE-2018-1999002
- https://www.exploit-db.com/exploits/46453/ exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISCPatchThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2018-1999002 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1609613 | Issue Tracking | |
| https://github.com/advisories/GHSA-qf38-f2fr-q4x9 | Advisory | |
| https://github.com/jenkinsci/jenkins/commit/29ca81dd59c255ad633f1bd86cf1be40a5f02c64 | ||
| https://github.com/jenkinsci/stapler/commit/8e9679b08c36a2f0cf2a81855d5e04e2ed2ac2b3 | ||
| https://jenkins.io/security/advisory/2018-07-18/#SECURITY-914 | x_refsource_CONFIRMMitigationVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2018-1999002 | ||
| https://www.cve.org/CVERecord?id=CVE-2018-1999002 | ||
| https://www.exploit-db.com/exploits/46453/ | exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry | |
| https://www.oracle.com/security-alerts/cpuapr2022.html | x_refsource_MISCPatchThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jul 23, 2018
Updated Aug 5, 2024
Reserved Jul 18, 2018
Link CVE-2018-1999002
CISA Vulnrichment
GHSA-QF38-F2FR-Q4X9 Updated n/a