CVE-2018-1000861: Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability

Vulnerability summary

CVE-2018-1000861 is a high (CVSS 10.0) Deserialization of Untrusted Data vulnerability in Jenkins Jenkins Stapler Web Framework. It is known to be exploited: CISA lists it, first on 10-02-2022. EPSS estimates a 98.33% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-12-2018
   PublishedVulnerability first disclosed.
2. 10-02-2022
   Added to CISA KEVJenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
3. 10-08-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.