CVE-2018-1000863
HIGH 8.2
En bref
- Source
- NVD
- EPSS
- EPSS 6.76 % · centile 94 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Description
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
Faiblesses (CWE)
- CWE-22 — Traversée de répertoire
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.2 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.4 | AV:N/AC:L/Au:N/C:N/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-4jhm-5f7g-75fp — Improper Limitation of a Pathname to a Restricted Directory in Jenkins
Références européennes
- ENISA EUVD · EUVD-2022-2398
- GCVE · GCVE-0-2018-1000863
Configurations affectées (CPE NVD)
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*≤ 2.138.3cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*≤ 2.153cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |