CVE-2013-0158 EPSS 2.5%

Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before…

Official description · CVE.org

Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.

Breakdown

51.9 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 0
Tactics: 0/15

First seen exploited 18 days after disclosure.

Disclosed24 Feb 2013day 0
First seen exploitedVulnCheck KEV evidence14 Mar 2013+18 days

See the family tree

3 related vulnerabilities in the same code over 6 years. The latest fix listed for jenkins-core is 1.502.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

This CVECVE-2013-0158Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS…24 Feb 2013
same family
CVE-2018-1000997A path traversal vulnerability exists in the Stapler web…23 Jan 2019
relatedHigh
Why these are linked:
- Fixed one release later1.250.2 → 1.257.1 (org.kohsuke.stapler:stapler-parent)
- Same code patched: Facet.java, GroovyFacet.java, JellyFacet.java (machine-matched)Functions: createRequestDispatcher, discoverExtensionscommit 0dfc28a commit 1963755
CVE-2019-10354A vulnerability in the Stapler web framework used in Jenkins…17 Jul 2019

Fixes in jenkins-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

1.491CVE-2012-607224 Feb 2013
1.491CVE-2012-607324 Feb 2013
1.491CVE-2012-607424 Feb 2013
1.498CVE-2013-015824 Feb 2013
1.502CVE-2013-032719 Mar 2013
1.502CVE-2013-032819 Mar 2013
1.502CVE-2013-032919 Mar 2013Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.jenkins-ci.main:jenkins-core.

Mavenorg.jenkins-ci.main:jenkins-coreGHSA-jwfr-h6jp-9p2g

Upgrade to 1.642.2

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2015-5317, CVE-2016-0792).

Still affected on this line by CVE-2016-9299 (fixed in 2.19.3, a newer line); CVE-2017-1000353 (fixed in 2.46.2, a newer line); CVE-2018-1000861 (fixed in 2.138.4, a newer line); CVE-2018-1999002 (fixed in 2.121.2, a newer line); CVE-2019-10405 (fixed in 2.176.4, a newer line); CVE-2020-2230 (fixed in 2.235.4, a newer line); CVE-2024-23897 (fixed in 2.426.3, a newer line); CVE-2025-59474 (fixed in 2.516.3, a newer line); CVE-2026-53435 (fixed in 2.555.3, a newer line).

Set the version to 1.642.2 or later in your pom.xml or build.gradle.

First fixed in 1.498 for CVE-2013-0158.

Affected versions, by release line

If you run	Upgrade to
1.481 up to 1.498	1.642.2first fix for this CVE: 1.498
All versions before 1.480.2 Still affected on this line by CVE-2015-5317 (fixed in 1.625.2, a newer line); CVE-2016-0792 (fixed in 1.642.2, a newer line); CVE-2016-9299 (fixed in 2.19.3, a newer line); CVE-2017-1000353 (fixed in 2.46.2, a newer line); CVE-2018-1000861 (fixed in 2.138.4, a newer line); CVE-2018-1999002 (fixed in 2.121.2, a newer line); CVE-2019-10405 (fixed in 2.176.4, a newer line); CVE-2020-2230 (fixed in 2.235.4, a newer line); CVE-2025-59474 (fixed in 2.516.3, a newer line); CVE-2026-53435 (fixed in 2.555.3, a newer line).	1.480.2

If you run

Upgrade to

1.481 up to 1.498

1.642.2first fix for this CVE: 1.498

All versions before 1.480.2

Still affected on this line by CVE-2015-5317 (fixed in 1.625.2, a newer line); CVE-2016-0792 (fixed in 1.642.2, a newer line); CVE-2016-9299 (fixed in 2.19.3, a newer line); CVE-2017-1000353 (fixed in 2.46.2, a newer line); CVE-2018-1000861 (fixed in 2.138.4, a newer line); CVE-2018-1999002 (fixed in 2.121.2, a newer line); CVE-2019-10405 (fixed in 2.176.4, a newer line); CVE-2020-2230 (fixed in 2.235.4, a newer line); CVE-2025-59474 (fixed in 2.516.3, a newer line); CVE-2026-53435 (fixed in 2.555.3, a newer line).

1.480.2

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

10 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-4445

No public exploit code found.

, 30 Oct 2026

2.5%Top 16%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 84.4%).

No CVSS score published.

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 4979 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.8439 16.9/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total51.9

Record

Published: 24 Feb 2013
Modified: 6 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in jenkins-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

References

x_refsource_CONFIRM 7

vendor-advisory 1

mailing-list 1

x_refsource_MISC 1

techniques