CVE-2018-1999047: Incorrect Authorization in Jenkins
Summary
CVE-2018-1999047: Incorrect Authorization in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.121.3
>= 2.122, < 2.138
Fixed in 2.121.3 or 2.138, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It is widely used in the software development industry and offers a range of features and plugins to support continuous integration and delivery. The Jenkins Core package, specifically versions 2.137 and earlier, 2.121.2 and earlier, is affected by an improper authorization vulnerability.
Vulnerability Detail
The vulnerability exists in the UpdateCenter.java file of Jenkins Core. Attackers can exploit this vulnerability to cancel a scheduled Jenkins restart through the update center. This unauthorized action can disrupt the normal operation of Jenkins and potentially impact the availability and integrity of software projects. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.121.32.121.3 -
>= 2.122, < 2.1382.138
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Jenkins.
Conclusion
The vulnerability in Jenkins Core, identified as CVE-2018-1999047, allows unauthorized cancellation of scheduled restarts. To mitigate this vulnerability, it is crucial to upgrade Jenkins to the recommended patched versions. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery in software development.
The vulnerability allows unauthorized cancellation of scheduled Jenkins restarts, potentially disrupting normal operations and compromising software project availability and integrity.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
To fix this vulnerability, upgrade your Jenkins installation to the recommended patched versions: 2.121.3 or later for versions 2.121.2 and earlier, and 2.138 or later for versions 2.122 and later.
No, there are no known workarounds for this vulnerability. Upgrading to the patched versions is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
