TI-2018-15723 Aliases CVE-2018-1000068 GHSA-x6jw-2f23-mc5j

An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier…

LOW 28CWE-200Published 2018-02-16 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitive file system.

Why it matters now

EPSS 0.01957 80th percentileScored 2026-11-07

Fix Partial org.jenkins-ci.main:jenkins-core (Maven): 2.89.4, 2.107Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	org.jenkins-ci.main:jenkins-core (Maven)	before 2.89.4	2.89.4	Patch available	GHSA-x6jw-2f23-mc5j
—	org.jenkins-ci.main:jenkins-core (Maven)	2.90 to before 2.107	2.107	Patch available	GHSA-x6jw-2f23-mc5j

— Vendor— Affected all versions Fixed in — No fix listed CNA
org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 2.89.4 Fixed in 2.89.4 Patch available GHSA-x6jw-2f23-mc5j
org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.90 to before 2.107 Fixed in 2.107 Patch available GHSA-x6jw-2f23-mc5j

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:jenkins::::::::	up to 2.106	Vulnerable	Jenkins
cpe:2.3:a:jenkins:jenkins:::::lts:::*	up to 2.89.3	Vulnerable	Jenkins
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:::::::*	1.9.0	Vulnerable	Oracle

cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* Versions up to 2.106 Vulnerable ·Jenkins
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions up to 2.89.3 Vulnerable ·Jenkins
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle

Remediation

Fix · GHSA-x6jw-2f23-mc5j org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.89.4 Advisory →
Fix · GHSA-x6jw-2f23-mc5j org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.107 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Enterprise 3	Affected	No fix yet

Timeline

2026-10-02 Threatist record created from CVE-2018-1000068
2026-10-03 Alias added: GHSA-x6jw-2f23-mc5j

References

Patch 1

https://www.oracle.com/security-alerts/cpuapr2022.html

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences