CVE-2018-1999002: Input Validation

Q: What is the severity of CVE-2018-1999002?

CVE-2018-1999002 is considered a medium severity vulnerability allowing arbitrary file reads.

Q: How do I fix CVE-2018-1999002?

To fix CVE-2018-1999002, upgrade Jenkins to version 2.132 or later, or to version 2.121.2.

Q: What versions of Jenkins are affected by CVE-2018-1999002?

Versions 2.132 and earlier, and 2.121.1 and earlier of Jenkins are affected by CVE-2018-1999002.

Q: What type of vulnerability is CVE-2018-1999002?

CVE-2018-1999002 is an arbitrary file read vulnerability in the Stapler web framework of Jenkins.

Q: Can CVE-2018-1999002 be exploited remotely?

Yes, CVE-2018-1999002 can be exploited remotely through crafted HTTP requests.

Published Jul 23, 2018

Updated

A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.

Affected Software

5 affected componentsFixes available

maven/org.jenkins-ci.main:jenkins-core>=2.122<2.132

2.132

maven/org.jenkins-ci.main:jenkins-core<2.121.2

2.121.2

Jenkins Jenkins<=2.121.1

Jenkins Jenkins>=2.122<=2.132

Oracle Communications Cloud Native Core Automated Test Suite=1.9.0

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpuapr2022.html

Event History

Jul 23, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

May 13, 2022

Advisory Published

01:01 AM

Frequently Asked Questions

What is the severity of CVE-2018-1999002?

CVE-2018-1999002 is considered a medium severity vulnerability allowing arbitrary file reads.

How do I fix CVE-2018-1999002?