CVE-2018-1000152: Jenkins vSphere Plugin incorrect authorization vulnerability
Summary
CVE-2018-1000152: Jenkins vSphere Plugin incorrect authorization vulnerability. Affects org.jenkins-ci.plugins:vsphere-cloud versions < 2.17. Fixed in 2.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins vSphere Plugin is a plugin for the Jenkins automation server that allows users to provision and manage virtual machines on vSphere infrastructure. It provides integration with vSphere, enabling users to create, clone, power on/off, and perform other operations on virtual machines.
Vulnerability Detail
An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older. The vulnerability affects various classes, including Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, and vSphereStep.java. Attackers can exploit this vulnerability to perform form validation related actions, such as sending numerous requests to the configured vSphere server, potentially leading to denial of service. Additionally, attackers can send credentials stored in Jenkins with known ID to an attacker-specified server by abusing the "test connection" feature. Starting from version 2.17, these form validation methods require POST requests and appropriate user permissions.
How To Fix
Latest published version: 5.706.v891625470e78 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the latest version of the Jenkins vSphere Plugin.
Conclusion
The Jenkins vSphere Plugin is vulnerable to an improper authorization issue that can lead to denial of service and unauthorized access to credentials. It is crucial to upgrade to the latest version of the plugin (2.17 or newer) to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:vsphere-cloud →
FAQ
The Jenkins vSphere Plugin is a plugin for the Jenkins automation server that enables users to provision and manage virtual machines on vSphere infrastructure.
This vulnerability allows attackers to perform form validation related actions and potentially cause denial of service by sending numerous requests to the vSphere server. It also enables attackers to send credentials stored in Jenkins to an attacker-specified server.
Versions 2.16 and older of the Jenkins vSphere Plugin are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the Jenkins vSphere Plugin.
To fix this vulnerability, upgrade the Jenkins vSphere Plugin to version 2.17 or newer.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:vsphere-cloud.
