CVE-2018-1000169: jenkins

Modified

AliasesRHBA-2018:1816GHSA-cpw3-x7gf-p872

Published 13-04-2018Last modified 05-08-2024

Vulnerability summary

CVE-2018-1000169 is a medium (CVSS 5.3) vulnerability in jenkins. EPSS estimates a 1.38% chance of exploitation in the next 30 days, higher than 72% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.3/10

010

Medium · v3.0 (NVD)

EPSS score

1.38%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

13-04-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptionHandler.java that allows unauthorized attackers to confirm the existence of agents or views with an attacker-specified name by sending a CLI command to Jenkins.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.05.3v2.05.0

EPSS trend

Probability

1.38%

Chance of exploitation in the next 30 days

Percentile

72%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.38% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat198 products

ansible-asb-modules< 0:0.2.1-1.el7
ansible-kubernetes-modules< 0:0.4.0-8.el7
ansible-service-broker< 0:1.2.17-1.el7
ansible-service-broker-container-scripts< 0:1.2.17-1.el7
ansible-service-broker-devel< 0:1.2.17-1.el7

ansible-service-broker-selinux< 0:1.2.17-1.el7
apb< 0:1.2.14-1.el7
apb-base-scripts< 0:1.2.7-1.el7
apb-container-scripts< 0:1.2.14-1.el7
atomic-enterprise-service-catalog< 1:3.10.14-1.git.1444.3b95d24.el7
atomic-enterprise-service-catalog-svcat< 1:3.10.14-1.git.1444.3b95d24.el7
atomic-openshift< 0:3.10.14-1.git.0.ba8ae6d.el7
atomic-openshift-clients< 0:3.10.14-1.git.0.ba8ae6d.el7
atomic-openshift-clients-redistributable< 0:3.10.14-1.git.0.ba8ae6d.el7
atomic-openshift-cluster-autoscaler< 0:3.10.14-1.git.0.5d093fd.el7
atomic-openshift-descheduler< 0:3.10.14-1.git.299.3f3c30b.el7
atomic-openshift-docker-excluder< 0:3.10.14-1.git.0.ba8ae6d.el7
atomic-openshift-dockerregistry< 0:3.10.14-1.git.387.07a726e.el7
atomic-openshift-excluder< 0:3.10.14-1.git.0.ba8ae6d.el7
atomic-openshift-hyperkube< 0:3.10.14-1.git.0.ba8ae6d.el7
atomic-openshift-hypershift< 0:3.10.14-1.git.0.ba8ae6d.el7
atomic-openshift-master< 0:3.10.14-1.git.0.ba8ae6d.el7
atomic-openshift-metrics-server< 0:3.10.14-1.git.49.382fff9.el7
atomic-openshift-node< 0:3.10.14-1.git.0.ba8ae6d.el7
atomic-openshift-node-problem-detector< 0:3.10.14-1.git.198.04596af.el7
atomic-openshift-pod< 0:3.10.14-1.git.0.ba8ae6d.el7
atomic-openshift-sdn-ovs< 0:3.10.14-1.git.0.ba8ae6d.el7
atomic-openshift-template-service-broker< 0:3.10.14-1.git.0.ba8ae6d.el7
atomic-openshift-tests< 0:3.10.14-1.git.0.ba8ae6d.el7
atomic-openshift-web-console< 0:3.10.14-1.git.334.3197fdf.el7
cockpit< 0:155-1.el7
cockpit-debuginfo< 0:155-1.el7
cockpit-kubernetes< 0:155-1.el7
cri-o< 0:1.10.5-1.rhaos3.10.git4c81456.el7
cri-tools< 0:1.0.0-5.rhaos3.10.git2e22a75.el7
cri-tools-debuginfo< 0:1.0.0-5.rhaos3.10.git2e22a75.el7
csi-attacher< 0:0.2.0-3.git27299be.el7
csi-attacher-debuginfo< 0:0.2.0-3.git27299be.el7
csi-driver-registrar< 0:0.2.0-1.el7
csi-driver-registrar-debuginfo< 0:0.2.0-1.el7
csi-livenessprobe< 0:0.0.1-1.gitff5b6a0.el7
csi-livenessprobe-debuginfo< 0:0.0.1-1.gitff5b6a0.el7
csi-provisioner< 0:0.2.0-2.el7
csi-provisioner-debuginfo< 0:0.2.0-2.el7
dumb-init< 0:1.1.3-12.el7
dumb-init-debuginfo< 0:1.1.3-12.el7
elastic-curator< 0:3.5.0-2.el7
elasticsearch< 0:2.4.4-3.el7
elasticsearch-cloud-kubernetes< 0:2.4.4.01_redhat_1-1.el7
fb303< 0:0.9.1-15.el7
fb303-devel< 0:0.9.1-15.el7
fb303-java< 0:0.9.1-15.el7
fluentd< 0:0.12.42-1.el7
fluentd-debuginfo< 0:0.12.42-1.el7
fluentd-doc< 0:0.12.42-1.el7
golang-github-openshift-oauth-proxy< 0:2.3-1.git57b68632.el7
golang-github-openshift-prometheus-alert-buffer< 0:0-2.gitceca8c1.el7
golang-github-prometheus-alertmanager< 0:0.14.0-1.git30af4d0.el7
golang-github-prometheus-node_exporter< 0:3.10.14-1.git.892.af036cb.el7
golang-github-prometheus-prometheus< 0:2.2.1-1.gitbc6058c.el7
golang-github-prometheus-promu< 0:0-2.git85ceabc.el7
google-cloud-sdk< 0:183.0.0-3.el7
haproxy< 0:1.8.8-1.el7
haproxy-debuginfo< 0:1.8.8-1.el7
haproxy18< 0:1.8.8-1.el7
hawkular-openshift-agent< 0:1.2.2-2.el7
heapster< 0:1.3.0-3.el7
image-inspector< 0:2.1.2-2.el7
imagebuilder< 0:0.0.1-1.el7
jenkins< 0:2.107.3.1525883128-1.el7
jenkins-1< 0:1.651.2-2.el7
jenkins-2-plugins< 0:3.10.1525788236-1.el7
jenkins-plugin-ace-editor< 0:1.1-10.el7
jenkins-plugin-authentication-tokens< 0:1.3-1.el7
jenkins-plugin-blueocean< 0:1.1.2-1.el7
jenkins-plugin-blueocean-autofavorite< 0:0.7-1.el7
jenkins-plugin-blueocean-commons< 0:1.0.1-1.el7
jenkins-plugin-blueocean-config< 0:1.0.1-1.el7
jenkins-plugin-blueocean-dashboard< 0:1.0.1-1.el7
jenkins-plugin-blueocean-display-url< 0:2.0-1.el7
jenkins-plugin-blueocean-events< 0:1.0.1-1.el7
jenkins-plugin-blueocean-git-pipeline< 0:1.0.1-1.el7
jenkins-plugin-blueocean-github-pipeline< 0:1.0.1-1.el7
jenkins-plugin-blueocean-i18n< 0:1.0.1-1.el7
jenkins-plugin-blueocean-jwt< 0:1.0.1-1.el7
jenkins-plugin-blueocean-personalization< 0:1.0.1-1.el7
jenkins-plugin-blueocean-pipeline-api-impl< 0:1.0.1-1.el7
jenkins-plugin-blueocean-pipeline-editor< 0:0.2.0-1.el7
jenkins-plugin-blueocean-rest< 0:1.0.1-1.el7
jenkins-plugin-blueocean-rest-impl< 0:1.0.1-1.el7
jenkins-plugin-blueocean-web< 0:1.0.1-1.el7
jenkins-plugin-branch-api< 0:2.0.9-10.el7
jenkins-plugin-cloudbees-folder< 0:6.0.4-10.el7
jenkins-plugin-credentials< 0:2.1.13-10.el7
jenkins-plugin-credentials-binding< 0:1.11-1.el7
jenkins-plugin-display-url-api< 0:2.0-10.el7
jenkins-plugin-docker-commons< 0:1.6-1.el7
jenkins-plugin-docker-workflow< 0:1.11-1.el7
jenkins-plugin-durable-task< 0:1.13-10.el7
jenkins-plugin-favorite< 0:2.0.4-1.el7
jenkins-plugin-git< 0:3.3.0-10.el7
jenkins-plugin-git-client< 0:2.4.5-10.el7
jenkins-plugin-git-server< 0:1.7-10.el7
jenkins-plugin-github< 0:1.27.0-1.el7
jenkins-plugin-github-api< 0:1.85-1.el7
jenkins-plugin-github-branch-source< 0:2.0.5-1.el7
jenkins-plugin-handlebars< 0:1.1.1-10.el7
jenkins-plugin-icon-shim< 0:2.0.3-10.el7
jenkins-plugin-jackson2-api< 0:2.7.3-1.el7
jenkins-plugin-jquery-detached< 0:1.2.1-10.el7
jenkins-plugin-junit< 0:1.20-10.el7
jenkins-plugin-kubernetes< 0:0.11-10.el7
jenkins-plugin-mailer< 0:1.20-10.el7
jenkins-plugin-mapdb-api< 0:1.0.9.0-10.el7
jenkins-plugin-matrix-auth< 0:1.5-10.el7
jenkins-plugin-matrix-project< 0:1.10-10.el7
jenkins-plugin-mercurial< 0:1.59-10.el7
jenkins-plugin-metrics< 0:3.1.2.9-1.el7
jenkins-plugin-momentjs< 0:1.1.1-10.el7
jenkins-plugin-multiple-scms< 0:0.6-10.el7
jenkins-plugin-openshift-client< 0:0.9.6-1.el7
jenkins-plugin-openshift-login< 0:0.12-10.el7
jenkins-plugin-openshift-pipeline< 0:1.0.47-10.el7
jenkins-plugin-openshift-sync< 0:0.1.24-1.el7
jenkins-plugin-pipeline-build-step< 0:2.1-10.el7
jenkins-plugin-pipeline-graph-analysis< 0:1.3-10.el7
jenkins-plugin-pipeline-input-step< 0:2.7-10.el7
jenkins-plugin-pipeline-milestone-step< 0:1.3.1-1.el7
jenkins-plugin-pipeline-model-api< 0:1.1.4-1.el7
jenkins-plugin-pipeline-model-declarative-agent< 0:1.1.1-1.el7
jenkins-plugin-pipeline-model-definition< 0:1.1.4-1.el7
jenkins-plugin-pipeline-model-extensions< 0:1.1.4-1.el7
jenkins-plugin-pipeline-rest-api< 0:2.6-10.el7
jenkins-plugin-pipeline-stage-step< 0:2.2-10.el7
jenkins-plugin-pipeline-stage-tags-metadata< 0:1.1.4-1.el7
jenkins-plugin-pipeline-stage-view< 0:2.6-10.el7
jenkins-plugin-pipeline-utility-steps< 0:1.3.0-10.el7
jenkins-plugin-plain-credentials< 0:1.4-10.el7
jenkins-plugin-pubsub-light< 0:1.8-1.el7
jenkins-plugin-scm-api< 0:2.1.1-10.el7
jenkins-plugin-script-security< 0:1.29-1.el7
jenkins-plugin-sse-gateway< 0:1.15-1.el7
jenkins-plugin-ssh-credentials< 0:1.13-10.el7
jenkins-plugin-structs< 0:1.6-10.el7
jenkins-plugin-subversion< 0:2.7.2-10.el7
jenkins-plugin-token-macro< 0:2.1-1.el7
jenkins-plugin-variant< 0:1.1-1.el7
jenkins-plugin-workflow-aggregator< 0:2.1-10.el7
jenkins-plugin-workflow-api< 0:2.13-10.el7
jenkins-plugin-workflow-basic-steps< 0:2.4-10.el7
jenkins-plugin-workflow-cps< 0:2.30-10.el7
jenkins-plugin-workflow-cps-global-lib< 0:2.8-10.el7
jenkins-plugin-workflow-durable-task-step< 0:2.11-10.el7
jenkins-plugin-workflow-job< 0:2.10-10.el7
jenkins-plugin-workflow-multibranch< 0:2.14-10.el7
jenkins-plugin-workflow-remote-loader< 0:1.4-10.el7
jenkins-plugin-workflow-scm-step< 0:2.4-10.el7
jenkins-plugin-workflow-step-api< 0:2.9-10.el7
jenkins-plugin-workflow-support< 0:2.14-10.el7
kibana< 0:4.6.4-4.el7
kibana-debuginfo< 0:4.6.4-4.el7
libthrift-java< 0:0.9.1-15.el7
libthrift-javadoc< 0:0.9.1-15.el7
libuv< 1:1.7.5-3.el7
libuv-debuginfo< 1:1.7.5-3.el7
libuv-devel< 1:1.7.5-3.el7
libuv-static< 1:1.7.5-3.el7
mariadb-apb-role< 0:1.2.5-1.el7
mediawiki< 0:1.27.4-8.el7
mediawiki-apb-role< 0:1.2.8-1.el7
mediawiki-container-scripts< 0:1.2.0-1.el7
mediawiki-doc< 0:1.27.4-8.el7
mysql-apb-role< 0:1.2.6-1.el7
nodejs< 0:4.7.2-1.el7
nodejs-abbrev< 0:1.0.7-1.el7aos
nodejs-accepts< 0:1.3.3-1.el7
nodejs-align-text< 0:0.1.3-2.el7aos
nodejs-amdefine< 0:0.0.4-5.el7aos
nodejs-ansi-regex< 0:2.0.0-1.el7aos
nodejs-ansi-styles< 0:2.1.0-1.el7aos
nodejs-argparse< 0:1.0.3-1.el7aos
nodejs-array-flatten< 0:1.1.1-1.el7aos
nodejs-asap< 0:2.0.3-1.el7aos
nodejs-asn1< 0:0.1.11-4.el7aos
nodejs-assert-plus< 0:0.1.4-1.el7aos
nodejs-async< 0:1.4.2-1.el7aos
nodejs-aws-sign2< 0:0.5.0-1.el7aos
nodejs-balanced-match< 0:0.2.1-1.el7aos
nodejs-base64url< 0:1.0.4-2.el7aos
nodejs-basic-auth< 0:1.0.3-1.el7aos
nodejs-bl< 0:1.0.0-3.el7aos
nodejs-bluebird< 0:2.10.0-1.el7aos
nodejs-body-parser< 0:1.14.1-1.el7aos
nodejs-boom< 0:2.8.0-1.el7aos
nodejs-brace-expansion< 0:1.1.1-1.el7aos
nodejs-bytes< 0:2.1.0-1.el7aos
nodejs-camelcase< 0:1.2.1-2.el7aos
nodejs-camelcase-keys< 0:1.0.0-2.el7aos

Show all 198

Jenkins1 product

jenkins≤ 2.105 | ≤ 2.107.1

Org.jenkins-ci.main1 product

jenkins-core< 2.107.2 | ≥ 2.108, < 2.116

3 vendors · 200 products · Showing 200 of 569

References

319 links

jenkins.io/security/advisory/2018-04-11/X Refsource CONFIRMVendor AdvisoryWEB
access.redhat.com/errata/RHBA-2018:1816Vendor AdvisoryX Refsource REDHATAdvisoryWEB
bugzilla.redhat.com/show_bug.cgi?id=1278733REPORT
bugzilla.redhat.com/show_bug.cgi?id=1416639REPORT
bugzilla.redhat.com/show_bug.cgi?id=1425022REPORT
bugzilla.redhat.com/show_bug.cgi?id=1470998REPORT
bugzilla.redhat.com/show_bug.cgi?id=1471718REPORT
bugzilla.redhat.com/show_bug.cgi?id=1477133REPORT
bugzilla.redhat.com/show_bug.cgi?id=1486953REPORT
bugzilla.redhat.com/show_bug.cgi?id=1490722REPORT

Show all 100 references

Showing 100 of 319.