A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that allows attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in
    core/src/main/java/hudson/model/FileParameterValue.java that allows attackers with Job/Configure
    permission to define a file parameter with a file name outside the intended directory, resulting in an
    arbitrary file write on the Jenkins master when scheduling a build. (CVE-2018-1000406)

The version of Jenkins running on the remote web server is prior to 2.146 or is a version of Jenkins LTS prior to 2.138.2. It is, therefore, affected by multiple vulnerabilities:
  - A cross-site scripting (XSS) vulnerability exists due to improper validation of user-supplied input before     returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a     specially crafted URL, to execute arbitrary script code in a user's browser session (CVE-2018-1000407).

  - A denial of service (DoS) vulnerability exists in the HudsonPrivateSecurityRealm class of Jenkins. An     unauthenticated, remote attacker can exploit this issue, by sending crafted, repeated HTTP requests to particular     URLs, to cause the application to stop responding (CVE-2018-1000408).

  - A directory traversal vulnerability exists in the version of the Stapler Web Framework, which is bundled with     Jenkins. An authenticated, remote attacker can exploit this, by sending a URI that contains directory traversal     characters, to disclose the contents of files located outside of the server's restricted path (CVE-2018-1000997).

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
409638	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-3pr8-rf62-g893)	Tenable Cloud Security	SCA Checks	medium
409638	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-3pr8-rf62-g893)	Tenable Self-Hosted Container Security	SCA Checks	medium
118147	Jenkins < 2.138.2 (LTS) / 2.146 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2018-1000406

medium

Tenable Plugins

medium

medium

high