CVE-2018-1000192

MEDIUM

Jenkins < 2.120 and LTS < 2.107.2 - Information Exposure in AboutJenkins.java and ListPluginsCommand.java

Title source: llm

Description

A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read access to enumerate all installed plugins.

References (2)

Core 2

Core References

Patch, Third Party Advisory x_refsource_misc

https://www.oracle.com/security-alerts/cpuapr2022.html

Vendor Advisory x_refsource_confirm

https://jenkins.io/security/advisory/2018-05-09/#SECURITY-771

Scores

CVSS v3 4.3

EPSS 0.0048

EPSS Percentile 65.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

Status published

Products (4)

jenkins/jenkins < 2.107.2

jenkins/jenkins < 2.120

oracle/communications_cloud_native_core_automated_test_suite 1.9.0

org.jenkins-ci.main/jenkins-core 0 - 2.107.3Maven

Published Jun 05, 2018

Tracked Since Feb 18, 2026