Description
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution EDB-46453 · webapps · Feb 25, 2019
GitHub 3 repositories
-
wetw0rk/Exploit-Development ★ 83 · Apr 26, 2017
CVE-2020-8012, CVE-2016-10709, CVE-2017-17099, CVE-2017-18047, CVE-2019-1003000, CVE-2018-1999002
-
0x6b7966/CVE-2018-1999002 ★ 1 · Sep 10, 2019
-
im23pds/CVE-2019-1003000-and-CVE-2018-1999002-Pre-Auth-RCE-Jenkins ★ 0 · Mar 6, 2019
Python CVE-2019-1003000 and CVE-2018-1999002 Pre-Auth RCE Jenkins
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.121.2 | 2.121.2 | GHSA-qf38-f2fr-q4x9 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.122, < 2.132 | 2.132 | GHSA-qf38-f2fr-q4x9 |