CVE-2018-1000862
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.
- Record
CVE-2018-1000862- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.
- Record
CVE-2018-1000862- Updated
- 2026-11-02
EUVDEUVD-2022-4184 No score
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.
- Record
EUVD-2022-4184- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hph9-9vcq-f7gp
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.
- Record
GHSA-hph9-9vcq-f7gp- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.
- Record
CVE-2018-1000862- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-hph9-9vcq-f7gp
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.
- Record
GHSA-hph9-9vcq-f7gp- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVRHBA-2019:0024
Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update
- Record
RHBA-2019:0024- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
through 2.138.3 | 2.138.4 |
org.jenkins-ci.main:jenkins-coreMaven |
2.140 to 2.153 | 2.154 |
org.jenkins-ci.main:jenkins-coreMaven |
before 2.138.4, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
2.138.4 |
org.jenkins-ci.main:jenkins-coreMaven |
2.140 up to 2.154, plus listed versions 2.1412.1422.1432.1442.145 Show 11 moreShow less2.1462.1472.1482.1492.1502.150.12.150.22.150.32.1512.1522.153 |
2.154 |
jenkinsRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:2.138.4.1544416383-1.el7 | 0:2.138.4.1544416383-1.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000862 is a medium vulnerability (CVSS 4.3) in Jenkins, published December 10, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.37%, the 72nd percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.138.4.
References
jenkins.io/security/advisory/2018-12-05
access.redhat.com/errata/RHBA-2019:0024
securityfocus.com/bid/106176
nvd.nist.gov/vuln/detail/CVE-2018-1000862
github.com/jenkinsci/jenkins/commit/c19cc705688cfffa4fe735e0edbe84862b6c135f
Show 67 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1503735
security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_0024.json
cve.org/CVERecord?id=CVE-2018-1000861
cisa.gov/known-exploited-vulnerabilities-catalog
Left out here: 451 versions. The JSON record has them.