What is CVE-2018-1000152?

CVE-2018-1000152 is a medium-severity vulnerability in Jenkins Vsphere, classified under Incorrect Authorization. CVSS score: 6.3/10. Published 2018-04-05.

How severe is CVE-2018-1000152?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Auth bypass in Jenkins Vsphere

CVE-2018-1000152

An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection").

Vulnerability class: Broken Access Control

EPSS: 0.007 (49.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Jenkins Vsphere
N/a — versions n/a

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-1000152?: CVE-2018-1000152 is a medium-severity vulnerability in Jenkins Vsphere, classified under Incorrect Authorization. CVSS score: 6.3/10. Published 2018-04-05.
How severe is CVE-2018-1000152?: Medium severity. CVSS v3 base score is 6.3 out of 10.