CVE-2018-1999042

MEDIUM

Jenkins <2.137-<2.121.2 - SSRF

Title source: llm

Description

A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.

References (1)

[Vendor Advisory] https://jenkins.io/security/advisory/2018-08-15/#SECURITY-637

Scores

CVSS v3 5.3

EPSS 0.0023

EPSS Percentile 45.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Classification

CWE

CWE-502

Status published

Affected Products (3)

jenkins/jenkins < 2.121.2

jenkins/jenkins < 2.137

org.jenkins-ci.main/jenkins-core < 2.121.3Maven

Timeline

Published Aug 23, 2018

Tracked Since Feb 18, 2026