CVE-2018-1000607: Input Validation
A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the permissions of the user the Jenkins master process is running as.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000607?
CVE-2018-1000607 is considered a high severity vulnerability due to the potential for unauthorized file overwrites on the Jenkins master file system.
How do I fix CVE-2018-1000607?
To fix CVE-2018-1000607, upgrade the Jenkins Fortify CloudScan Plugin to version 1.5.2 or later.
What are the affected versions of the Jenkins Fortify CloudScan Plugin for CVE-2018-1000607?
The affected versions of the Jenkins Fortify CloudScan Plugin are 1.5.1 and earlier.
What kind of exploits can occur due to CVE-2018-1000607?
Exploiting CVE-2018-1000607 can allow attackers to overwrite any file on the Jenkins master file system, using controlled rulepack zip file contents.
Who is affected by CVE-2018-1000607?
Any Jenkins installation using Fortify CloudScan Plugin version 1.5.1 or earlier is potentially affected by CVE-2018-1000607.