Every CVE Search/ Get API key

CVE-2018-1000997

Improper Limitation of a Pathname to a Restricted Directory in Jenkins

6.5 MediumFix available

A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

3.26%Up 2.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation.

Record
CVE-2018-1000997
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
CVE List No score

A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation.

Record
CVE-2018-1000997
Updated
2026-11-02
EUVDEUVD-2022-2595 No score

A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation.

Record
EUVD-2022-2595
Updated
2026-11-03
GitHub AdvisoriesGHSA-5hfp-964w-5vgm 6.5

Improper Limitation of a Pathname to a Restricted Directory in Jenkins

A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation.

Record
GHSA-5hfp-964w-5vgm
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 6.5

A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation.

Record
CVE-2018-1000997
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-5hfp-964w-5vgm 6.5

Improper Limitation of a Pathname to a Restricted Directory in Jenkins

A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation.

Record
GHSA-5hfp-964w-5vgm
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVRHBA-2018:3743 6.5

Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update

Record
RHBA-2018:3743
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.main:jenkins-core
Maven
 through 2.138.1
2.138.2
org.jenkins-ci.main:jenkins-core
Maven
 2.140 to 2.145
2.146
org.kohsuke.stapler:stapler-parent
Maven
 before 1.250.2
1.250.2
org.jenkins-ci.main:jenkins-core
Maven
 before 2.138.2, plus listed versions
1.3961.3971.3981.3991.400
Show 45 moreShow less
1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437
2.138.2
org.jenkins-ci.main:jenkins-core
Maven
 2.140 up to 2.146, plus listed versions
2.1412.1422.1432.1442.145
2.146
org.kohsuke.stapler:stapler-parent
Maven
 before 1.250.2, plus listed versions
1.1001.1011.1021.1031.104
Show 45 moreShow less
1.1051.1061.1071.1081.1091.1101.1111.1121.1131.1141.1151.1161.1171.1181.1191.1201.1211.1221.1231.1241.1251.1261.1271.1281.1291.1301.1311.1321.1331.1341.1351.1361.1371.1381.1391.1401.1411.1421.1431.1441.1451.1461.1471.1481.149
1.250.2
atomic-enterprise-service-catalog
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 1:3.11.51-1.git.1671.2d16650.el7
1:3.11.51-1.git.1671.2d16650.el7
atomic-enterprise-service-catalog-svcat
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 1:3.11.51-1.git.1671.2d16650.el7
1:3.11.51-1.git.1671.2d16650.el7
atomic-openshift
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.1560686.el7
0:3.11.51-1.git.0.1560686.el7
atomic-openshift-clients
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.1560686.el7
0:3.11.51-1.git.0.1560686.el7
Show 40 moreShow less
Affected packages
PackageAffectedFixed
atomic-openshift-clients-redistributable
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.1560686.el7
0:3.11.51-1.git.0.1560686.el7
atomic-openshift-cluster-autoscaler
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.0aa9fc2.el7
0:3.11.51-1.git.0.0aa9fc2.el7
atomic-openshift-descheduler
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.300.89070e8.el7
0:3.11.51-1.git.300.89070e8.el7
atomic-openshift-docker-excluder
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.1560686.el7
0:3.11.51-1.git.0.1560686.el7
atomic-openshift-dockerregistry
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.446.d29ce0e.el7
0:3.11.51-1.git.446.d29ce0e.el7
atomic-openshift-excluder
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.1560686.el7
0:3.11.51-1.git.0.1560686.el7
atomic-openshift-hyperkube
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.1560686.el7
0:3.11.51-1.git.0.1560686.el7
atomic-openshift-hypershift
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.1560686.el7
0:3.11.51-1.git.0.1560686.el7
atomic-openshift-master
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.1560686.el7
0:3.11.51-1.git.0.1560686.el7
atomic-openshift-metrics-server
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.52.03e3a91.el7
0:3.11.51-1.git.52.03e3a91.el7
atomic-openshift-node
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.1560686.el7
0:3.11.51-1.git.0.1560686.el7
atomic-openshift-node-problem-detector
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.254.22189b0.el7
0:3.11.51-1.git.254.22189b0.el7
atomic-openshift-pod
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.1560686.el7
0:3.11.51-1.git.0.1560686.el7
atomic-openshift-sdn-ovs
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.1560686.el7
0:3.11.51-1.git.0.1560686.el7
atomic-openshift-service-idler
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.14.813574a.el7
0:3.11.51-1.git.14.813574a.el7
atomic-openshift-template-service-broker
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.1560686.el7
0:3.11.51-1.git.0.1560686.el7
atomic-openshift-tests
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.1560686.el7
0:3.11.51-1.git.0.1560686.el7
atomic-openshift-web-console
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.324.0ae64ed.el7
0:3.11.51-1.git.324.0ae64ed.el7
cri-o
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:1.11.10-1.rhaos3.11.git42c86f0.el7
0:1.11.10-1.rhaos3.11.git42c86f0.el7
cri-o-debuginfo
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:1.11.10-1.rhaos3.11.git42c86f0.el7
0:1.11.10-1.rhaos3.11.git42c86f0.el7
golang-github-openshift-oauth-proxy
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.419.1af74df.el7
0:3.11.51-1.git.419.1af74df.el7
golang-github-prometheus-alertmanager
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.50a0687.el7
0:3.11.51-1.git.0.50a0687.el7
golang-github-prometheus-node_exporter
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.1063.12dd8be.el7
0:3.11.51-1.git.1063.12dd8be.el7
golang-github-prometheus-prometheus
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.5023.0ad933c.el7
0:3.11.51-1.git.5023.0ad933c.el7
jenkins
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:2.138.2.1542054911-1.el7
0:2.138.2.1542054911-1.el7
jenkins-2-plugins
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.1542061886-1.el7
0:3.11.1542061886-1.el7
kibana
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:5.6.13-1.el7
0:5.6.13-1.el7
kibana-debuginfo
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:5.6.13-1.el7
0:5.6.13-1.el7
openshift-ansible
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-2.git.0.51c90a3.el7
0:3.11.51-2.git.0.51c90a3.el7
openshift-ansible-docs
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-2.git.0.51c90a3.el7
0:3.11.51-2.git.0.51c90a3.el7
openshift-ansible-playbooks
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-2.git.0.51c90a3.el7
0:3.11.51-2.git.0.51c90a3.el7
openshift-ansible-roles
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-2.git.0.51c90a3.el7
0:3.11.51-2.git.0.51c90a3.el7
openshift-ansible-test
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-2.git.0.51c90a3.el7
0:3.11.51-2.git.0.51c90a3.el7
openshift-enterprise-autoheal
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.219.8ea4275.el7
0:3.11.51-1.git.219.8ea4275.el7
openshift-enterprise-cluster-capacity
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.380.ffa21af.el7
0:3.11.51-1.git.380.ffa21af.el7
openshift-monitor-project-lifecycle
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.59.7b59e29.el7
0:3.11.51-1.git.59.7b59e29.el7
openshift-monitor-sample-app
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.5.f6d0188.el7
0:3.11.51-1.git.5.f6d0188.el7
prometheus
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.5023.0ad933c.el7
0:3.11.51-1.git.5023.0ad933c.el7
prometheus-alertmanager
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.0.50a0687.el7
0:3.11.51-1.git.0.50a0687.el7
prometheus-node-exporter
Red Hat:openshift:3.11::el7
From an advisory covering 8 CVEs
 before 0:3.11.51-1.git.1063.12dd8be.el7
0:3.11.51-1.git.1063.12dd8be.el7

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-1000997 is a medium vulnerability (CVSS 6.5) in Jenkins, published January 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.26%, the 88th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.138.2.

References

Show 48 moreShow less
This page doesn't list everything

Left out here: 548 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open