CVE-2018-1000058

EPSS 1.3%
Veröffentlicht 09.02.2018 23:29:02
Zuletzt bearbeitet 21.11.2024 03:39:32
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deserialization like readResolve implemented in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Jenkins ≫ Pipeline Supporting Apis SwPlatformjenkins Version <= 2.17

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.3%	0.789

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	6.5	8	6.4	AV:N/AC:L/Au:S/C:P/I:P/A:P

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://jenkins.io/security/advisory/2018-02-05/

Vendor Advisory

http://www.securityfocus.com/bid/103034

Third Party Advisory

VDB Entry

https://nvd.nist.gov/vuln/detail/CVE-2018-1000058

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-1000058

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-1000058

EUVD