CVE-2018-1000863: Path Traversal
First published: Mon Dec 10 2018(Updated: )
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.jenkins-ci.main:jenkins-core | >=2.140<=2.153 | 2.154 |
| maven/org.jenkins-ci.main:jenkins-core | <=2.138.3 | 2.138.4 |
| Jenkins Jenkins | <=2.138.3 | |
| Jenkins Jenkins | <=2.153 | |
| Redhat Openshift Container Platform | =3.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/106176
- https://access.redhat.com/errata/RHBA-2019:0024
- https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072
- https://www.tenable.com/security/research/tra-2018-43
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000863
- https://github.com/jenkinsci/jenkins/commit/4ed66e5838476e575a83c3cd13fffb37eefa2f48
- https://github.com/jenkinsci/jenkins/commit/7bae6dd6ef23af988801d38dc0f8f693bc6283f8
- https://github.com/advisories/GHSA-4jhm-5f7g-75fp (Advisory)
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-4jhm-5f7g-75fp
- alias/CVE-2018-1000863
- collector/nvd-cve
- collector/github-advisory
- agent/weakness
- agent/type
- agent/event
- agent/severity
- agent/author
- agent/references
- agent/description
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/jenkins
- canonical/jenkins jenkins
- version/jenkins jenkins/2.138.3
- version/jenkins jenkins/2.153
- vendor/redhat
- canonical/redhat openshift container platform
- version/redhat openshift container platform/3.11
- package-manager/maven