Exploit for CVE-2018-1999002

kitploit · 2026-08-26

Description

CVE-2018-1999002 affects a tools repository; no README provided for context.

Entry point

Parameter.ini · path

Pathplugin/credentials/.ini

Pre-auth arbitrary file read via Stapler/locale handling (path traversal-like) vulnerability exploiting Accept-Language localization to access arbitrary files.

Affected Jenkins versions

Jenkins≤ 2.121.1, 2.132

All known vulnerabilities by product

Jenkins

CVSS 7.5 for CVE-2018-1999002

7.5

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:NONE

Availability:NONE

EPSS Score

86.6%higher than 99.7% of all CVEs

Updated 2026-08-28

CVE Information

CVE-2018-1999002

Exploit Details

Modified:2026-08-26 19:58

Last Seen:2026-08-26 22:44

Reporter:KitPloit

Other exploits for CVE-2018-1999002

CVE-2019-1003000-and-CVE-2018-1999002-Pre-Auth-RCE-Jenkins

2026-08-26 KitPloitKITPLOIT

Jenkins Plugin Script Security 1.49Declarative 1.3.4Groovy 2.60 - Remote Code Execution

2019-02-25 wetw0rkEXPLOITPACKPython

Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution

2019-02-25 wetw0rkEXPLOITDBPython

Jenkins Script Security 1.49 / Declarative 1.3.4 / Groovy 2.60 Remote Code Execution

2019-02-25 wetw0rkPACKETSTORM

Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution Exploit

2019-02-25 wetw0rkZDTPython

Jenkins 任意文件读取漏洞(CVE-2018-1999002)

2018-07-26 My SeebugSEEBUG

Exploit for OS Command Injection in Pfsense

2017-04-26 wetw0rkGITHUB

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-0X6B7966-CVE-2018-1999002
Questo repository non contiene un README.

Exploit Code

Share

Share on social media: