CVE-2018-1000863: Path Traversal
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000863?
CVE-2018-1000863 is classified as a medium severity vulnerability.
How do I fix CVE-2018-1000863?
To fix CVE-2018-1000863, upgrade Jenkins to version 2.154 or later, or LTS version 2.138.4 or later.
What is the impact of CVE-2018-1000863 on Jenkins?
CVE-2018-1000863 allows attackers to submit malicious user names, potentially preventing users from logging into Jenkins.
Which versions of Jenkins are affected by CVE-2018-1000863?
Jenkins versions 2.153 and earlier, as well as LTS version 2.138.3 and earlier are affected by CVE-2018-1000863.
Is CVE-2018-1000863 associated with specific software distributions?
Yes, CVE-2018-1000863 is associated with Jenkins and Red Hat OpenShift Container Platform version 3.11.