CVE-2018-1999002
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
- Affected products
- Jenkins
- Jenkins
- ≤ 2.121.1, 2.132
- Fix
- Available
- CVSS 3.1
- 7.5 HIGH
- EPSS
- 86.6% (100th percentile)
- NVD status
- Modified
- Published
- 2018-07-23
CVE-2018-1999002 at NVD
8 known exploits for CVE-2018-1999002
Proof-of-concept code and exploit modules indexed by Sploitus
CVE-2019-1003000-and-CVE-2018-1999002-Pre-Auth-RCE-Jenkins
CVE-2018-1999002
Jenkins Plugin Script Security 1.49Declarative 1.3.4Groovy 2.60 - Remote Code Execution
Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution
Jenkins Script Security 1.49 / Declarative 1.3.4 / Groovy 2.60 Remote Code Execution
Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution Exploit
Jenkins 任意文件读取漏洞(CVE-2018-1999002)
Exploit for OS Command Injection in Pfsense