CVE-2018-1000193

MEDIUM

Jenkins < 2.120 and LTS < 2.107.2 - User Impersonation via Control Character Injection in Username

Title source: llm

Description

A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and cannot be deleted via the UI.

References (2)

Core 2

Core References

Patch, Third Party Advisory x_refsource_misc

https://www.oracle.com/security-alerts/cpuapr2022.html

Vendor Advisory x_refsource_confirm

https://jenkins.io/security/advisory/2018-05-09/#SECURITY-786

Scores

CVSS v3 4.3

EPSS 0.0076

EPSS Percentile 73.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Details

CWE

CWE-74

Status published

Products (4)

jenkins/jenkins < 2.107.2

jenkins/jenkins < 2.120

oracle/communications_cloud_native_core_automated_test_suite 1.9.0

org.jenkins-ci.main/jenkins-core 0 - 2.107.3Maven

Published Jun 05, 2018

Tracked Since Feb 18, 2026