CVE-2018-1000169: Exposure of Sensitive Information in Jenkins
Summary
CVE-2018-1000169: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.107.2
>= 2.108, < 2.116
Fixed in 2.107.2 or 2.116, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that allows developers to build, test, and deploy their software projects. It is widely used in the software development industry and provides a range of features and plugins to support continuous integration and delivery. The vulnerability identified as CVE-2018-1000169 affects Jenkins versions 2.115 and older, as well as LTS 2.107.1 and older. This vulnerability exposes sensitive information to unauthorized actors by allowing them to confirm the existence of agents or views with a specified name through CLI commands.
Vulnerability Detail
The exposure of sensitive information vulnerability in Jenkins arises from a flaw in the CLICommand.java and ViewOptionHandler.java files. Attackers can exploit this vulnerability by sending a specially crafted CLI command to Jenkins. By analyzing the response, they can determine whether agents or views with the specified name exist in the system. This information disclosure can aid attackers in planning further attacks or gathering intelligence about the Jenkins environment. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.107.22.107.2 -
>= 2.108, < 2.1162.116
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to the CLI (Command Line Interface) by disabling it or implementing access controls. By limiting the usage of the CLI, the risk of unauthorized actors exploiting this vulnerability can be reduced. However, this workaround may impact legitimate use cases that rely on the CLI functionality.
Conclusion
The exposure of sensitive information vulnerability in Jenkins (CVE-2018-1000169) allows unauthorized actors to confirm the existence of agents or views with a specified name. This information disclosure can be exploited by attackers to gather intelligence or plan further attacks. It is crucial to upgrade Jenkins to the recommended versions or implement access controls to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability allows unauthorized actors to confirm the existence of agents or views with a specified name in Jenkins. This information disclosure can aid attackers in planning further attacks or gathering intelligence about the Jenkins environment.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including CVE-2018-1000169.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is essential to apply the recommended fixes and stay updated to mitigate any potential risks.
While upgrading Jenkins to the recommended versions is the best approach to mitigate this vulnerability, you can also implement access controls to restrict CLI usage or disable the CLI temporarily. However, these workarounds may impact legitimate use cases that rely on the CLI functionality.
For more information about this vulnerability, you can refer to the GitHub Security Advisory database at https://github.com/github/advisory-database/advisories/GHSA-cpw3-x7gf-p872.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
