What is CVE-2018-1999001?

CVE-2018-1999001 is a high-severity vulnerability in Jenkins. CVSS score: 8.8/10. Published 2018-07-23.

How severe is CVE-2018-1999001?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2018-1999001 known to be exploited?

6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Jenkins

CVE-2018-1999001

A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allows attackers to provide crafted login credentials that cause Jenkins to move the config.xml file from the Jenkins home directory. If Jenkins is started without this file present, it will revert to the legacy defaults of granting administrator access to anonymous users.

EPSS: 0.181 (96.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Jenkins
Oracle Communications_cloud_native_core_automated_test_suite — versions 1.9.0
N/a — versions n/a

Public proof-of-concept exploits

References

cve@mitre.org (Patch, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (x_refsource_CONFIRM, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2018-1999001?: CVE-2018-1999001 is a high-severity vulnerability in Jenkins. CVSS score: 8.8/10. Published 2018-07-23.
How severe is CVE-2018-1999001?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2018-1999001 known to be exploited?: 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.