CVE-2018-1000863

A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.

Published: Dec 10, 2018
Updated: May 9, 2024
CVE: CVE-2018-1000863
GHSA: GHSA-4jhm-5f7g-75fp
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CVSS v2:

Severity: Medium
Score: 6.4
AV:N/AC:L/Au:N/C:N/I:P/A:P

CWEs:

CWE-22

OWASP TOP 10:

A5 - Broken Access Control

Affected Software
References

Software	From	Fixed in
jenkins / jenkins	-	2.138.3.x
jenkins / jenkins	-	2.153.x
redhat / openshift_container_platform	3.11	3.11.x
org.jenkins-ci.main / jenkins-core	-	2.138.4
org.jenkins-ci.main / jenkins-core	2.140	2.154

http://www.securityfocus.com/bid/106176
https://access.redhat.com/errata/RHBA-2019:0024
https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072
https://www.tenable.com/security/research/tra-2018-43

Vulnerability Database

289,599

CVE-2018-1000863