CVE-2018-1000863

HIGH8.2EPSS 6.2%

Improper Limitation of a Pathname to a Restricted Directory in Jenkins

Published: 5/13/2022Modified: 2/16/2024

Description

A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.

Affected packages (1)

Maven/org.jenkins-ci.main:jenkins-corefrom 0, < 2.138.4

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.2	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

References (8)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2018-1000863
PATCHhttps://github.com/jenkinsci/jenkins
WEBhttps://access.redhat.com/errata/RHBA-2019:0024
WEBhttps://github.com/jenkinsci/jenkins/commit/4ed66e5838476e575a83c3cd13fffb37eefa2f48
WEBhttps://github.com/jenkinsci/jenkins/commit/7bae6dd6ef23af988801d38dc0f8f693bc6283f8
WEBhttps://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072
WEBhttps://www.tenable.com/security/research/tra-2018-43
WEBhttp://www.securityfocus.com/bid/106176