Unauthorized modification of configuration in Jenkins - CVE-2018-1999001
Published: July 26, 2018
Vulnerability identifier: #VU14003
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1999001
CWE-ID: CWE-16
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass security restrictions.
The vulnerability exists due to unauthorized modification of configuration in User.java. A remote attacker can provide crafted login credentials and cause Jenkins to move the config.xml file from the Jenkins home directory. If Jenkins is started without this file present, it will revert to the legacy defaults of granting administrator access to anonymous users.
Affected software
Jenkins
Arch Linux
Arch Linux
How to mitigate CVE-2018-1999001
The vulnerability is addressed in the versions 1.121.2, 1.133.
Jenkins - addressed in versions 2.121.2, 2.133