CVE-2018-1000111: Medium severity jenkins subversion Jenkins vulnerability
An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and SubversionRepositoryStatus.java that allows an attacker with network access to obtain a list of nodes and users. As of version 2.10.3, the class handling requests to /subversion/ no longer extends the class handling requests to the …/search/ sub-path, therefore any such requests will fail.
Other sources
An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and SubversionRepositoryStatus.java that allows an attacker with network access to obtain a list of nodes and users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.plugins:subversionto a version that resolves this vulnerability.Fixed in 2.10.3 - Upgrade
Upgrade
Jenkins Subversion Pluginto a version that resolves this vulnerability.Fixed in 2.10.3
Event History
Frequently Asked Questions
What is CVE-2018-1000111?
CVE-2018-1000111 is an improper authorization vulnerability in Jenkins Subversion Plugin version 2.10.2 and earlier.
What is the severity of CVE-2018-1000111?
The severity of CVE-2018-1000111 is medium with a CVSS score of 5.3.
How does CVE-2018-1000111 affect Jenkins Subversion Plugin?
CVE-2018-1000111 allows an attacker with network access to obtain a list of nodes and users.
What software versions are affected by CVE-2018-1000111?
The Jenkins Subversion Plugin version 2.10.2 and earlier are affected by CVE-2018-1000111.
How can I fix CVE-2018-1000111?
To fix CVE-2018-1000111, you should update Jenkins Subversion Plugin to a version later than 2.10.2.