TI-2018-15844 Aliases CVE-2018-1000195 GHSA-rgmj-mccj-h9mx

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS…

LOW 24CWE-352Published 2018-06-05 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352.

Summary

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful (200) or not.

Why it matters now

EPSS 0.02036 81st percentileScored 2026-11-07

Fix Partial org.jenkins-ci.main:jenkins-core (Maven): 2.107.3, 2.121Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	org.jenkins-ci.main:jenkins-core (Maven)	before 2.107.3	2.107.3	Patch available	GHSA-rgmj-mccj-h9mx
—	org.jenkins-ci.main:jenkins-core (Maven)	2.108 to before 2.121	2.121	Patch available	GHSA-rgmj-mccj-h9mx

— Vendor— Affected all versions Fixed in — No fix listed CNA
org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 2.107.3 Fixed in 2.107.3 Patch available GHSA-rgmj-mccj-h9mx
org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.108 to before 2.121 Fixed in 2.121 Patch available GHSA-rgmj-mccj-h9mx

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:jenkins::::::::	up to 2.120	Vulnerable	Jenkins
cpe:2.3:a:jenkins:jenkins:::::lts:::*	up to 2.107.2	Vulnerable	Jenkins
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:::::::*	1.9.0	Vulnerable	Oracle

cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* Versions up to 2.120 Vulnerable ·Jenkins
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions up to 2.107.2 Vulnerable ·Jenkins
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle

Remediation

Fix · GHSA-rgmj-mccj-h9mx org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.107.3 Advisory →
Fix · GHSA-rgmj-mccj-h9mx org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.121 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Enterprise 3	Affected	No fix yet

Timeline

2026-10-02 Threatist record created from CVE-2018-1000195
2026-10-03 Alias added: GHSA-rgmj-mccj-h9mx

References

Patch 1

https://www.oracle.com/security-alerts/cpuapr2022.html

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences