CVE-2018-1000863
Improper Limitation of a Pathname to a Restricted Directory in Jenkins
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
- Record
CVE-2018-1000863- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
- Record
CVE-2018-1000863- Updated
- 2026-11-02
EUVDEUVD-2022-2398 No score
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
- Record
EUVD-2022-2398- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4jhm-5f7g-75fp
Improper Limitation of a Pathname to a Restricted Directory in Jenkins
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
- Record
GHSA-4jhm-5f7g-75fp- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
- Record
CVE-2018-1000863- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVGHSA-4jhm-5f7g-75fp
Improper Limitation of a Pathname to a Restricted Directory in Jenkins
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
- Record
GHSA-4jhm-5f7g-75fp- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVRHBA-2019:0024
Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update
- Record
RHBA-2019:0024- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
through 2.138.3 | 2.138.4 |
org.jenkins-ci.main:jenkins-coreMaven |
2.140 to 2.153 | 2.154 |
org.jenkins-ci.main:jenkins-coreMaven |
before 2.138.4, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
2.138.4 |
org.jenkins-ci.main:jenkins-coreMaven |
2.140 up to 2.154, plus listed versions 2.1412.1422.1432.1442.145 Show 11 moreShow less2.1462.1472.1482.1492.1502.150.12.150.22.150.32.1512.1522.153 |
2.154 |
jenkinsRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:2.138.4.1544416383-1.el7 | 0:2.138.4.1544416383-1.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000863 is a high vulnerability (CVSS 8.2) in Jenkins, published December 10, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.76%, the 94th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.138.4.
References
jenkins.io/security/advisory/2018-12-05
access.redhat.com/errata/RHBA-2019:0024
securityfocus.com/bid/106176
tenable.com/security/research/tra-2018-43
nvd.nist.gov/vuln/detail/CVE-2018-1000863
github.com/jenkinsci/jenkins/commit/4ed66e5838476e575a83c3cd13fffb37eefa2f48
Show 70 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1503735
security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_0024.json
cve.org/CVERecord?id=CVE-2018-1000861
cisa.gov/known-exploited-vulnerabilities-catalog
Left out here: 451 versions. The JSON record has them.