Medium severity4.2NVD Advisory· Published Aug 1, 2018· Updated Jun 17, 2026

CVE-2018-1999038

Description

A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:publish-over-cifsMaven	< 0.11	0.11

Affected products

ghsa-coords
pkg:maven/org.jenkins-ci.plugins/publish-over-cifs
Range: < 0.11

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-rf7h-9m85-535vghsaADVISORY
jenkins.io/security/advisory/2018-07-30/nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2018-1999038ghsaADVISORY
github.com/jenkinsci/publish-over-cifs-plugin/commit/9402d8c1044508c2fc30a5dd1e34afe6819616a0ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.273
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000