CVE-2018-1999005: Cross-Site Scripting Vulnerability in Jenkins
Summary
CVE-2018-1999005: Improper Neutralization of Input During Web Page Generation in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.121.2
>= 2.122, < 2.132
Fixed in 2.121.2 or 2.132, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support continuous integration and delivery processes. The vulnerable package, org.jenkins-ci.main:jenkins-core, is a core component of Jenkins responsible for its fundamental functionality.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1999005, is a cross-site scripting (XSS) vulnerability in Jenkins versions 2.132 and earlier, as well as 2.121.1 and earlier. It exists in the BuildTimelineWidget.java file and control.jelly file, allowing attackers with Job/Configure permission to inject malicious JavaScript code. When another user performs certain actions in the Jenkins user interface, the injected code is executed in their browser. This can lead to various attacks, such as session hijacking, data theft, or unauthorized actions on behalf of the user.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.121.22.121.2 -
>= 2.122, < 2.1322.132
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Jenkins is not immediately feasible, a temporary workaround is to restrict Job/Configure permission to trusted users only. By limiting the number of users with this permission, the attack surface is reduced, and the likelihood of exploitation decreases. However, this workaround does not eliminate the vulnerability entirely and should be considered a temporary measure until the upgrade can be performed.
Conclusion
The cross-site scripting vulnerability in Jenkins versions 2.132 and earlier, as well as 2.121.1 and earlier, poses a moderate risk to users with Job/Configure permission. Upgrading to the recommended versions or applying the temporary workaround will mitigate the vulnerability. It is crucial to stay updated with security patches and follow best practices to ensure the security of Jenkins installations. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability allows attackers to execute arbitrary JavaScript code in the browsers of other users. This can lead to various attacks, including session hijacking, data theft, or unauthorized actions on behalf of the user.
Users of Jenkins versions 2.132 and earlier, as well as 2.121.1 and earlier, are affected by this vulnerability. Specifically, users with Job/Configure permission are at risk.
At the time of this report, there are no known public exploits targeting this vulnerability. However, it is crucial to apply the recommended fixes promptly to mitigate the risk.
No, this vulnerability requires the attacker to have Job/Configure permission in Jenkins. It cannot be exploited remotely without authenticated access to the Jenkins instance.
There is no evidence of active attacks exploiting this vulnerability at the time of this report. However, it is essential to apply the recommended fixes to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
