CVE-2018-1000861

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

Published: Dec 10, 2018
Updated: May 9, 2024
CVE: CVE-2018-1000861
GHSA: GHSA-hhpm-5cp2-hg4x
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 10
AV:N/AC:L/Au:N/C:C/I:C/A:C

CWEs:

CWE-502

OWASP TOP 10:

A8 - Insecure Deserialization

Affected Software
References

Software	From	Fixed in
jenkins / jenkins	-	2.138.3.x
jenkins / jenkins	-	2.153.x
redhat / openshift_container_platform	3.11	3.11.x
org.jenkins-ci.main / jenkins-core	-	2.138.4
org.jenkins-ci.main / jenkins-core	2.140	2.154

http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html
http://www.securityfocus.com/bid/106176
https://access.redhat.com/errata/RHBA-2019:0024
https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595

Vulnerability Database

CVE-2018-1000861

Deep Security Visibility Without the Complexity