CVE-2018-1000862: Infoleak
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000862?
CVE-2018-1000862 is considered a medium severity vulnerability due to the potential for information exposure.
How do I fix CVE-2018-1000862?
To fix CVE-2018-1000862, upgrade Jenkins to version 2.154 or later, or LTS version 2.138.4 or later.
What software versions are affected by CVE-2018-1000862?
CVE-2018-1000862 affects Jenkins versions 2.153 and earlier, and LTS versions 2.138.3 and earlier.
What kind of vulnerability is CVE-2018-1000862?
CVE-2018-1000862 is an information exposure vulnerability that allows unauthorized file system browsing.
Can CVE-2018-1000862 be exploited remotely?
Yes, CVE-2018-1000862 can be exploited by attackers who control build outputs on Jenkins agents.