CVE-2018-1000861

CRITICAL9.8⚠ KEVEPSS 94.5%

Deserialization of Untrusted Data in Jenkins

Published: 5/13/2022Modified: 10/22/2025Added to CISA KEV: 2/10/2022

Description

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

Affected packages (1)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1CRITICAL9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

References (7)