CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2018-1000067
Medium (5.3). EPSS 1.7% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.main:jenkins-core 2.107, 2.89.4.
An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response.
Severity
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:jenkins
- oracle:communications_cloud_native_core_automated_test_suite
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6mv9-hcx5-7mhh | Maven | org.jenkins-ci.main:jenkins-core | <2.89.4 | 2.89.4 |
| GHSA-6mv9-hcx5-7mhh | Maven | org.jenkins-ci.main:jenkins-core | >=2.90 <2.107 | 2.107 |