GHSA-qf38-f2fr-q4x9

Improper Input Validation in Jenkins

Source: GitHub Advisory Database (reviewed) High CVE-2018-1999002

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.main:jenkins-core	< 2.121.2	2.121.2
Maven	org.jenkins-ci.main:jenkins-core	>= 2.122, < 2.132	2.132

Details

As written in the advisory (Markdown source, shown as plain text).

A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1999002 advisory
https://github.com/jenkinsci/jenkins/commit/29ca81dd59c255ad633f1bd86cf1be40a5f02c64 web
https://github.com/jenkinsci/stapler/commit/8e9679b08c36a2f0cf2a81855d5e04e2ed2ac2b3 web
https://github.com/jenkinsci/jenkins package
https://jenkins.io/security/advisory/2018-07-18/#SECURITY-914 web
https://www.exploit-db.com/exploits/46453 web
https://www.oracle.com/security-alerts/cpuapr2022.html web