A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and…
Priority LOW 30CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the permissions of the user the Jenkins master process is running as.
Why it matters now
EPSS 0.00852 58th percentileScored 2026-11-07
Fix Fixed org.jenkins-ci.plugins:fortify-cloudscan-jenkins-plugin (Maven): 1.5.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.jenkins-ci.plugins:fortify-cloudscan-jenkins-plugin (Maven) | before 1.5.2 | 1.5.2 | Patch available | GHSA-8864-pwhg-3mp2 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.jenkins-ci.plugins:fortify-cloudscan-jenkins-plugin (Maven) Vendor— Affected before 1.5.2 Fixed in 1.5.2 Patch available GHSA-8864-pwhg-3mp2
Remediation
- Fix · GHSA-8864-pwhg-3mp2 org.jenkins-ci.plugins:fortify-cloudscan-jenkins-plugin (Maven) Fixed in 1.5.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1000607
- 2026-10-03 Alias added: GHSA-8864-pwhg-3mp2
References
Sources
- CVE-2018-1000607 · CVE Program
- CVE-2018-1000607 · NVD
- FIRST EPSS
- GHSA-8864-pwhg-3mp2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences