cve.bz

CVE-2018-1000861

9.8 criticalKEVEPSS 98%

Critical (9.8) in Jenkins Jenkins Stapler Web Framework. In CISA KEV since 2022-02-10. EPSS 98% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.main:jenkins-core 2.138.4, 2.154.

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
98% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-11-01)
CISA KEV
listed 2022-02-10, due 2022-08-10
CWE
CWE-502
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-hhpm-5cp2-hg4xMavenorg.jenkins-ci.main:jenkins-core<2.138.42.138.4
GHSA-hhpm-5cp2-hg4xMavenorg.jenkins-ci.main:jenkins-core>=2.140 <2.1542.154

References

Check your stackJSON