CVE-2018-1000861criticalunder attackCWE-502

CVE-2018-1000861

Published · Updated

Follow this CVE+ Monitor Jenkins Stapler Web Framework+ Monitor org.jenkins-ci.main:jenkins-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 98%
from disclosure to weapon135 days
Published on NVDDec 10
1st PoC+135d
metasploit+29d
CISA KEV+1158d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
8 products (13 components)
Red Hat OpenShift Container Platform 3.10 · Red Hat OpenShift Container Platform 3.2 · Red Hat OpenShift Container Platform 3.6 · Red Hat OpenShift Container Platform 3.7 · Red Hat OpenShift Container Platform 3.9 · and others 3
none_available: Affected
Fixed
1 product (2 components)
Red Hat OpenShift Container Platform 3.11
fix ↗
Not affected
1 product (82 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 3.11
Action required by CISAfederal deadline: 2022-08-10

Apply updates per vendor instructions.

In short

Jenkins versions up to 2.153 contain a vulnerability in the Stapler framework that allows attackers to execute arbitrary code by accessing specially crafted URLs, bypassing intended access restrictions on Java methods.

Technical detail

A deserialization and reflection-based code execution flaw in Stapler's MetaClass.java enables remote attackers to invoke unintended Java methods through crafted HTTP requests. The vulnerability affects Jenkins 2.153 and LTS 2.138.3 and earlier, with no authentication required; successful exploitation results in remote code execution with Jenkins process privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.