Unauthorized modification of configuration in Jenkins - CVE-2018-1999001
Published: July 26, 2018
Vulnerability identifier: #VU14003
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-1999001
CWE-ID: CWE-16
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Jenkins
Affected software:
Jenkins
Jenkins
Detailed vulnerability description
The vulnerability allows a remote attacker to bypass security restrictions.
The vulnerability exists due to unauthorized modification of configuration in User.java. A remote attacker can provide crafted login credentials and cause Jenkins to move the config.xml file from the Jenkins home directory. If Jenkins is started without this file present, it will revert to the legacy defaults of granting administrator access to anonymous users.
How to mitigate CVE-2018-1999001
The vulnerability is addressed in the versions 1.121.2, 1.133.