CVE-2018-1000863

A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.

CVSS v3.0 NVD

8.2 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CVSS v2.0 NVD

6.4 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P

EPSS

6.76% chance of exploitation in the next 30 days, 94th percentile

Published

2018-12-10

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://www.tenable.com/security/research/tra-2018-43

Security advisories

• https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072
• http://www.securityfocus.com/bid/106176
• https://access.redhat.com/errata/RHBA-2019:0024
• advisories/GHSA-4jhm-5f7g-75fp

References

• CVE Record
• NVD entry