CVE-2018-1000997

Description

A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation.

How to fix CVE-2018-1000997

To remediate CVE-2018-1000997, upgrade the affected package to a fixed version below.

• —upgrade to 2.138.2 or later
• —upgrade to 1.250.2 or later

Is CVE-2018-1000997 being exploited?

Low — EPSS is 1.9%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 2.138.2
• from 0, < 1.250.2

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-1000997
• PATCHgithub.com/jenkinsci/jenkins
• WEBgithub.com/jenkinsci/jenkins/commit/fd5f5be0304c6bf1918892b81e2efb6b6d09c521
• WEBgithub.com/jenkinsci/stapler/commit/0dfc28aa2102a59638484fc11c4c53b1dbb2baf0