CVE-2018-1000997: Path Traversal
A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000997?
CVE-2018-1000997 is rated as a medium severity vulnerability due to potential path traversal issues.
How do I fix CVE-2018-1000997?
To fix CVE-2018-1000997, upgrade to Jenkins version 2.146 or later, or 2.138.2 or later for LTS versions.
What software is affected by CVE-2018-1000997?
CVE-2018-1000997 affects Jenkins versions 2.145 and earlier, and LTS versions 2.138.1 and earlier.
What is the nature of the vulnerability identified in CVE-2018-1000997?
The vulnerability in CVE-2018-1000997 is a path traversal vulnerability in the Stapler web framework.
Can CVE-2018-1000997 be exploited remotely?
Yes, CVE-2018-1000997 can be exploited remotely if the affected Jenkins instance is reachable and misconfigured.