// For flags

CVE-2018-1000058

 

Severity Score

8.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deserialization like readResolve implemented in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.

Jenkins Pipeline: Supporting APIs Plugin, en versiones 2.17 y anteriores, tiene una ejecución de código arbitrario debido a una protección del sandbox incompleta. Los métodos relacionados con la deserialización Java, como readResolve implementado en los scripts de Pipeline, no estaban sometidos a mecanismos de protección de sandboxes y podrían ejecutar código arbitrario en consecuencia. Por ejemplo, se podría explotar con usuarios normales de Jenkins con el permiso para configurar Pipelines en Jenkins o con committers de confianza en repositorios que contengan Jenkinsfiles.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-02-05 CVE Reserved
  • 2018-02-09 CVE Published
  • 2024-08-05 CVE Updated
  • 2024-09-12 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-502: Deserialization of Untrusted Data
CAPEC
References (2)
URL Tag Source
http://www.securityfocus.com/bid/103034 Third Party Advisory
URL Date SRC
URL Date SRC
URL Date SRC
https://jenkins.io/security/advisory/2018-02-05 2018-03-06
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Jenkins
Search vendor "Jenkins"
 Pipeline Supporting Apis
Search vendor "Jenkins" for product "Pipeline Supporting Apis"
 <= 2.17
Search vendor "Jenkins" for product "Pipeline Supporting Apis" and version " <= 2.17"
jenkins
Affected