CVE-2018-1999002 Public exploit EPSS 86.6%

A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web…

Summary

The flaw is an arbitrary file read vulnerability in the Stapler web framework's org/kohsuke/stapler/Stapler.java component, as used in Jenkins 2.132 and earlier and 2.121.1 and earlier.

Official description · CVE.org

A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.

Breakdown

25.6 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (PoC-in-GitHub) was available 15 months before disclosure.

Public exploit codePoC-in-GitHub26 Apr 201715 mo before
Disclosed23 Jul 2018day 0

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.jenkins-ci.main:jenkins-core.

Mavenorg.jenkins-ci.main:jenkins-coreGHSA-qf38-f2fr-q4x9

Upgrade to 2.555.3 or later

Fixes this CVE and 7 other known vulnerabilities in this package (CVE-2018-1000861, CVE-2019-10405, +5).

Set the version to 2.555.3 or later in your pom.xml or build.gradle.

First fixed in 2.132 for CVE-2018-1999002.

Affected versions, by release line

If you run	Upgrade to
2.122 up to 2.132	2.555.3first fix for this CVE: 2.132
All versions before 2.121.2 Still affected on this line by CVE-2018-1000861 (fixed in 2.138.4, a newer line); CVE-2019-10405 (fixed in 2.176.4, a newer line); CVE-2020-2230 (fixed in 2.235.4, a newer line); CVE-2024-23897 (fixed in 2.426.3, a newer line); CVE-2025-59474 (fixed in 2.516.3, a newer line); CVE-2026-53435 (fixed in 2.555.3, a newer line).	2.121.2

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 1 community threat pulse (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Oracle Critical Patch Update Advisory - April 202220 Apr 2022

References

3 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-4954

Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code ExecutionEDB-46453 · webapps · java · 2019-02-25

, 30 Oct 2026

86.6%Top 0.26%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.74%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9974 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 advisory exploit reference; 3 PoC-in-GitHub repos 5.0/5

Mentioned in OTX pulses1 pulse 0.7/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total25.6

Record

Published: 23 Jul 2018
Modified: 5 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 1 community threat pulse (AlienVault OTX)

References

exploit 1

x_refsource_MISC 1

x_refsource_CONFIRM 1

techniques