10

CVE-2018-1000861

Warning

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

Data is provided by the National Vulnerability Database (NVD)
Jenkins ≫ Jenkins SwEditionlts Version <= 2.138.3
Jenkins ≫ Jenkins SwEdition- Version <= 2.153

10.02.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability

Vulnerability

A code execution vulnerability exists in the Stapler web framework used by Jenkins

Description

Apply updates per vendor instructions.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 94.49% 1
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.