CVE-2018-1999006: Infoleak
A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackers to determine the date and time when a plugin HPI/JPI file was last extracted, which typically is the date of the most recent installation/upgrade.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1999006?
CVE-2018-1999006 is classified as a moderate severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2018-1999006?
To remediate CVE-2018-1999006, upgrade Jenkins to version 2.133 or later.
What versions of Jenkins are affected by CVE-2018-1999006?
Jenkins versions 2.132 and earlier, as well as 2.121.1 and earlier, are affected by CVE-2018-1999006.
What type of information is exposed in CVE-2018-1999006?
CVE-2018-1999006 allows attackers to determine the date and time of the last extraction of a plugin HPI/JPI file.
Is CVE-2018-1999006 a remote exploit?
CVE-2018-1999006 does not require remote access to be exploited, but it does expose sensitive information that could aid attackers.