Vulnerability in Jenkins
CVE-2018-1999001
A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allows attackers to provide crafted login credentials that cause Jenkins to move the config.xml file from the Jenkins home directory. If Jenkins is started without this file present, it will revert to the legacy defaults of granting administrator access to anonymous users.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.181 (97.1th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.181 · newest: 0.181 · change: 0.000
Affected products
- Jenkins
- Oracle Communications Cloud Native Core Automated Test Suite — versions 1.9.0
Public proof-of-concept exploits
References
- www.oracle.com/security-alerts/cpuapr2022.html (Patch, Third Party Advisory)
- jenkins.io/security/advisory/2018-07-18/ (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-1999001?
- CVE-2018-1999001 is a high-severity vulnerability in Jenkins. CVSS score: 8.8/10. Published 2018-07-23.
- How severe is CVE-2018-1999001?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2018-1999001 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.