GitHub Advisoryadvisory · Maven

GHSA-4jhm-5f7g-75fp Improper Limitation of a Pathname to a Restricted Directory in Jenkins

HIGH Published 2022-05-13 Modified 2022-06-30 Official page ↗
Aliases
CVE-2018-1000863
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-22
Reviewed
2022-06-30

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.138.4 → fixed in 2.138.4 • Maven org.jenkins-ci.main:jenkins-core: >= 2.140, < 2.154 → fixed in 2.154

Description

A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.

Related

Alias · CVE (1)

  • CVE-2018-1000863 A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References