CVE-2018-1000997
Description
A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven | < 2.138.2 | 2.138.2 |
org.jenkins-ci.main:jenkins-coreMaven | >= 2.140, < 2.146 | 2.146 |
org.kohsuke.stapler:stapler-parentMaven | < 1.250.2 | 1.250.2 |
Affected products
51.324-rc, 1.325-rc, 1.327-rc, …+ 2 more
- (no CPE)range: 1.324-rc, 1.325-rc, 1.327-rc, …
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*range: <=2.145
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*range: <=2.138.1
- ghsa-coords2 versions
< 2.138.2+ 1 more
- (no CPE)range: < 2.138.2
- (no CPE)range: < 1.250.2
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-5hfp-964w-5vgmghsaADVISORY
- jenkins.io/security/advisory/2018-10-10/nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2018-1000997ghsaADVISORY
- github.com/jenkinsci/jenkins/commit/fd5f5be0304c6bf1918892b81e2efb6b6d09c521ghsaWEB
- github.com/jenkinsci/stapler/commit/0dfc28aa2102a59638484fc11c4c53b1dbb2baf0ghsaWEB
News mentions
0No linked articles in our index yet.