CVE-2018-1999002
Improper Input Validation in Jenkins
CVE-2018-1999002 is a high vulnerability (CVSS 7.5) in Jenkins, published July 23, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 86.6%, the 99th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.121.2.
- Severity
- 7.5 HighCVSS 3.1, NVD
- Exploit chance
- 86.6%EPSS, 99th percentile
- Exploitation
- None known4 public exploits
- Fixed in
2.121.2org.jenkins-ci.main:jenkins-core +3 more
Description
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven | before 2.121.2 | 2.121.2 |
org.jenkins-ci.main:jenkins-coreMaven | 2.122 up to 2.132 | 2.132 |
org.jenkins-ci.main:jenkins-coreMaven | before 2.121.2, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 | 2.121.2 |
org.jenkins-ci.main:jenkins-coreMaven | 2.122 up to 2.132, plus listed versions 2.1232.1242.1252.1262.127 Show 4 moreShow less2.1282.1292.1302.131 | 2.132 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | wetw0rk/Exploit-Development | 2017-04-26 |
| Exploit-DB | Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution | 2019-02-25 |
| PoC in GitHub | im23pds/CVE-2019-1003000-and-CVE-2018-1999002-Pre-Auth-RCE-Jenkins | 2019-03-06 |
| PoC in GitHub | 0x6b7966/CVE-2018-1999002 | 2019-09-10 |
What each source reports
NVD Score used
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
- Record
CVE-2018-1999002- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE ListNo score
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
- Record
CVE-2018-1999002- Updated
- 2026-11-02
EUVDEUVD-2022-4954No score
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
- Record
EUVD-2022-4954- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qf38-f2fr-q4x9
Improper Input Validation in Jenkins
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
- Record
GHSA-qf38-f2fr-q4x9- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
- Record
CVE-2018-1999002- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-qf38-f2fr-q4x9
Improper Input Validation in Jenkins
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
- Record
GHSA-qf38-f2fr-q4x9- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
exploit-db.com/exploits/46453
oracle.com/security-alerts/cpuapr2022.html
jenkins.io/security/advisory/2018-07-18
nvd.nist.gov/vuln/detail/CVE-2018-1999002
github.com/jenkinsci/jenkins/commit/29ca81dd59c255ad633f1bd86cf1be40a5f02c64
Left out here: 429 versions. The JSON record has them.