CVE-2018-1999007: Cross-Site Scripting Vulnerability in Jenkins
Summary
CVE-2018-1999007: Cross-site scripting vulnerability exists in Jenkins and Stapler Plugin. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.121.2
>= 2.122, < 2.132
Fixed in 2.121.2 or 2.132, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support continuous integration and delivery processes. The vulnerable package, org.jenkins-ci.main:jenkins-core, is a core component of Jenkins responsible for handling web requests and rendering web pages.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1999007, is a cross-site scripting (XSS) vulnerability in Jenkins. It exists in versions 2.132 and earlier, as well as 2.121.1 and earlier, in the Stapler web framework's org/kohsuke/stapler/Stapler.java file. Attackers who can control certain URLs in Jenkins can inject malicious JavaScript code that will be executed in another user's browser when that user views HTTP 404 error pages while Stapler debug mode is enabled. This can lead to unauthorized access, data theft, and potential manipulation of the affected user's session.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.121.22.121.2 -
>= 2.122, < 2.1322.132
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable Stapler debug mode in Jenkins. This can be done by modifying the Jenkins configuration file and setting the 'stapler.jelly.noCache' property to 'true'. However, this workaround may impact debugging capabilities and should only be considered until the Jenkins upgrade can be performed.
Conclusion
The cross-site scripting vulnerability in Jenkins can expose users to potential security risks, including unauthorized access and data theft. It is crucial to apply the recommended fixes and upgrades to ensure the security of Jenkins installations. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability allows attackers to execute arbitrary JavaScript code in the context of another user's browser. This can lead to unauthorized access, data theft, and potential manipulation of the affected user's session.
Users of Jenkins versions 2.132 and earlier, as well as 2.121.1 and earlier, are affected by this vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the necessary patches and security updates to mitigate the risk.
Yes, this vulnerability can be exploited remotely by attackers who can control certain URLs in Jenkins.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
