An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descriptor.java that allows attackers with Overall/Administer permission or access to the local file system to obtain credentials entered by users if the form submission could not be successfully processed.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and
    the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java,
    core/src/main/java/hudson/model/Descriptor.java that allows attackers with Overall/Administer permission
    or access to the local file system to obtain credentials entered by users if the form submission could not
    be successfully processed. (CVE-2018-1000410)

The version of Jenkins running on the remote web server is prior to 2.146 or is a version of Jenkins LTS prior to 2.138.2. It is, therefore, affected by multiple vulnerabilities:
  - A cross-site scripting (XSS) vulnerability exists due to improper validation of user-supplied input before     returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a     specially crafted URL, to execute arbitrary script code in a user's browser session (CVE-2018-1000407).

  - A denial of service (DoS) vulnerability exists in the HudsonPrivateSecurityRealm class of Jenkins. An     unauthenticated, remote attacker can exploit this issue, by sending crafted, repeated HTTP requests to particular     URLs, to cause the application to stop responding (CVE-2018-1000408).

  - A directory traversal vulnerability exists in the version of the Stapler Web Framework, which is bundled with     Jenkins. An authenticated, remote attacker can exploit this, by sending a URI that contains directory traversal     characters, to disclose the contents of files located outside of the server's restricted path (CVE-2018-1000997).

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
410530	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-53jp-gmwc-jwf6)	Tenable Cloud Security	SCA Checks	high
410530	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-53jp-gmwc-jwf6)	Tenable Self-Hosted Container Security	SCA Checks	high
118147	Jenkins < 2.138.2 (LTS) / 2.146 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2018-1000410

high

Tenable Plugins

high

high

high