CVE-2018-1999002
HighPublic exploitImproper Input Validation in Jenkins
Published May 13, 2022 · Updated Jul 8, 2026 · Also known as GHSA-qf38-f2fr-q4x9
Key Facts
Patch immediately- CVE-2018-1999002 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Jenkins, Communications Cloud Native Core Automated Test Suite (Oracle), org.jenkins-ci.main:jenkins-core (maven).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 86% probability of exploitation in the next 30 days.
- Fixed versions are available, including Jenkins 2.133-1, Jenkins <=2.121.1, org.jenkins-ci.main:jenkins-core 2.121.2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
86%
Higher than 99.7% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2018-1999002 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
Affected Products
4 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| JenkinsJenkins | See advisory | 2.121.1 |
| Communications Cloud Native Core Automated Test SuiteOracle | 1.9.0 | n/a |
| org.jenkins-ci.main:jenkins-coremaven | See advisory | 2.132 |
Patched Releases
Jenkins
2.133-1, <=2.121.1
org.jenkins-ci.main:jenkins-core
2.121.2, 2.132
Timeline
Publicly disclosed
May 13, 2022
Last updated
Jul 8, 2026
Weakness Type
- CWE-20 Improper Input Validation
References
- advisoryGHSA advisory
- advisoryhttps://jenkins.io/security/advisory/2018-07-18/#SECURITY-914
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2018-1999002
- patchhttps://www.oracle.com/security-alerts/cpuapr2022.html
- exploitExploitDB-46453
FAQ
Common Questions.
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
Affected: Jenkins; Communications Cloud Native Core Automated Test Suite (Oracle) versions 1.9.0; org.jenkins-ci.main:jenkins-core (maven). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Jenkins 2.133-1, Jenkins <=2.121.1, org.jenkins-ci.main:jenkins-core 2.121.2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2018-1999002 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo