medium4.3
CVE-2018-1000192
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Impact
A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read access to enumerate all installed plugins.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.main:jenkins-core | <= 2.107.2 | 2.107.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Jenkins | through 2.120 through 2.107.2 |
| Oracle | Communications Cloud Native Core Automated Test Suite | Version 1.9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://jenkins.io/security/advisory/2018-05-09/#SECURITY-771
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://github.com/advisories/GHSA-2w4x-rxp7-grg7
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000192
- https://github.com/jenkinsci/jenkins/commit/7c5b41bfd5d8004f82684a9168dd627e20ea5f35
- https://github.com/jenkinsci/jenkins/commit/809916b59b7c7678dc3c1c76338452121fed1424