CVE-2018-1000058
HIGHJenkins Pipeline: Supporting APIs Plugin <2.17 - Code Injection
Title source: llmDescription
Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deserialization like readResolve implemented in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.
Scores
CVSS v3
8.8
EPSS
0.0130
EPSS Percentile
79.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-502
Status
published
Affected Products (2)
jenkins/pipeline_supporting_apis
< 2.17
org.jenkins-ci.plugins.workflow/workflow-support
< 2.18Maven
Timeline
Published
Feb 09, 2018
Tracked Since
Feb 18, 2026