Is CVE-2018-1999002 actively exploited?

CVE-2018-1999002 has no public evidence of in-the-wild exploitation as of 2024-11-21.

What is the CVSS score for CVE-2018-1999002?

CVE-2018-1999002 has a CVSS score of 7.5 (HIGH severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

How do I patch CVE-2018-1999002?

Patch guidance is available from jenkins security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2018-1999002.

Fix CVE-2018-1999002 - HIGH jenkins jenkins

Q: Which products are affected by CVE-2018-1999002?

3 products: jenkins jenkins, jenkins jenkins, oracle communications cloud native core automated test suite.

Description

A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
Weaknesses: NVD-CWE-noinfo

Metadata

Primary Vendor: JENKINS
Published: 7/23/2018
Last Modified: 11/21/2024
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

jenkins : jenkinsjenkins : jenkinsoracle : communications_cloud_native_core_automated_test_suite

Remediation Guidance

Executive Summary

View on NIST NVD