CVE-2018-1999002: Improper Input Validation in Jenkins
Summary
CVE-2018-1999002: Improper Input Validation in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.121.2
>= 2.122, < 2.132
Fixed in 2.121.2 or 2.132, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support continuous integration and delivery processes. The vulnerable package in focus is 'org.jenkins-ci.main:jenkins-core'.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1999002, exists in Jenkins versions 2.132 and earlier, as well as 2.121.1 and earlier. It stems from an improper input validation issue in the Stapler web framework's 'org/kohsuke/stapler/Stapler.java' file. Attackers can exploit this vulnerability by sending crafted HTTP requests, which can result in the disclosure of sensitive information. Specifically, an attacker can retrieve the contents of any file on the Jenkins master file system that the Jenkins master has access to. This can lead to unauthorized access, data leakage, and potential compromise of the Jenkins server.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.121.22.121.2 -
>= 2.122, < 2.1322.132
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Jenkins master file system by implementing appropriate network and access controls. Additionally, it is crucial to regularly monitor and review access logs for any suspicious activity.
Conclusion
In conclusion, the vulnerability CVE-2018-1999002 in Jenkins exposes a risk of unauthorized file read. It is crucial to promptly update to the recommended versions or apply the temporary workaround to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for building, testing, and deploying software projects.
The vulnerable package is 'org.jenkins-ci.main:jenkins-core'.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
An attacker can exploit this vulnerability by sending crafted HTTP requests, allowing them to read the contents of any file on the Jenkins master file system.
This vulnerability can lead to unauthorized access, data leakage, and potential compromise of the Jenkins server.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
