CVE-2018-1000407: Cross-site Scripting in Jenkins
Summary
CVE-2018-1000407: Cross-site Scripting in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.138.2
>= 2.140, < 2.146
Fixed in 2.138.2 or 2.146, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations, making it a popular choice for continuous integration and delivery (CI/CD) pipelines. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core'.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1000407, is a cross-site scripting (XSS) vulnerability that exists in Jenkins versions 2.145 and earlier, as well as LTS 2.138.1 and earlier. The vulnerability is located in the 'Api.java' file within the 'core/src/main/java/hudson/model' directory. Attackers can exploit this vulnerability by specifying URLs to Jenkins, which can result in the rendering of arbitrary HTML controlled by the attacker. This can lead to various security risks, including the execution of malicious scripts and the potential for phishing attacks.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.138.22.138.2 -
>= 2.140, < 2.1462.146
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the rendering of HTML in Jenkins by configuring the 'Markup Formatter' setting to 'Plain Text' in the Jenkins global security configuration. This will prevent the execution of any injected scripts but may impact the rendering of legitimate HTML content.
Conclusion
In conclusion, the CVE-2018-1000407 vulnerability in Jenkins exposes users to the risk of cross-site scripting attacks. It is crucial to upgrade to the fixed versions mentioned or apply the workaround to mitigate the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for building, testing, and deploying software projects.
Cross-site scripting is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability allows attackers to execute arbitrary HTML and potentially malicious scripts within the Jenkins environment, posing a risk of data theft, unauthorized access, and phishing attacks.
No, only Jenkins versions 2.145 and earlier, as well as LTS 2.138.1 and earlier, are affected. Upgrading to the fixed versions will resolve the vulnerability.
Yes, users can temporarily disable HTML rendering in Jenkins by configuring the 'Markup Formatter' setting to 'Plain Text' in the Jenkins global security configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
