CVE-2018-1000195: Cross-Site Request Forgery in Jenkins
Summary
CVE-2018-1000195: Cross-Site Request Forgery in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.107.3
>= 2.108, < 2.121
Fixed in 2.107.3 or 2.121, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It is widely used for continuous integration and delivery. The vulnerable package, org.jenkins-ci.main:jenkins-core, is a core component of Jenkins responsible for its main functionality.
Vulnerability Detail
A server-side request forgery vulnerability exists in Jenkins versions 2.120 and older, LTS 2.107.2 and older. The vulnerability is present in the ZipExtractionInstaller.java file and allows users with Overall/Read permission to make Jenkins submit a HTTP GET request to any URL of their choice. By analyzing the response, the user can determine whether the request was successful (200) or not. This vulnerability can be exploited to perform unauthorized actions on behalf of the user, potentially leading to data leakage or unauthorized access.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.107.32.107.3 -
>= 2.108, < 2.1212.121
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict Overall/Read permission to trusted users only. This can be done by modifying the Jenkins configuration to limit access to the affected functionality. Here is an example of how to restrict Overall/Read permission using the Jenkins Script Console:
import jenkins.model.Jenkins;
import hudson.security.Permission;
Jenkins.instance.getAuthorizationStrategy().getGrantedPermissions(Permission.READ).clear();
Jenkins.instance.save();
Please note that this workaround should be considered temporary, and upgrading to a fixed version is still recommended.
Conclusion
In conclusion, the Cross-Site Request Forgery vulnerability in Jenkins can allow unauthorized actions to be performed by users with Overall/Read permission. It is crucial to upgrade to the fixed versions mentioned or apply the temporary workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
This vulnerability allows an attacker to perform unauthorized actions on behalf of a user with Overall/Read permission. The impact can range from data leakage to unauthorized access to sensitive information or systems.
Users of Jenkins versions 2.120 and older, as well as LTS 2.107.2 and older, are affected by this vulnerability. It is important to upgrade to the fixed versions mentioned in the 'How to Fix' section.
At the time of this report, there are no known public exploits for this vulnerability. However, it is always recommended to apply security patches promptly to mitigate the risk.
Yes, this vulnerability can be exploited remotely. An attacker can craft a malicious request and trick a user with Overall/Read permission to execute it, leading to potential unauthorized actions.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level. It is important to address this vulnerability to prevent potential security incidents.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
