CVEvulnerability
CVE-2018-1000863
8.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-12-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.2 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:P
- Weaknesses
- CWE-22
Description
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
Affected configurations
• jenkins jenkins (<= 2.138.3)
• jenkins jenkins (<= 2.153)
• redhat openshift container platform 3.11
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://www.securityfocus.com/bid/106176 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHBA-2019:0024 Third Party Advisory
- https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072 Vendor Advisory
- https://www.tenable.com/security/research/tra-2018-43 Exploit, Third Party Advisory
- http://www.securityfocus.com/bid/106176 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHBA-2019:0024 Third Party Advisory
- https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072 Vendor Advisory
- https://www.tenable.com/security/research/tra-2018-43 Exploit, Third Party Advisory