Read the docs
TI-2018-16080 Aliases CVE-2018-1000861GHSA-hhpm-5cp2-hg4x

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153…

Priority CRITICAL 100Exploited in the wildCWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 8 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

Why it matters now

Exploitation Active In CISA KEV since 2022-02-10CISA due date 2022-08-10
EPSS 0.98326 99th percentileScored 2026-11-07
Fix Partial org.jenkins-ci.main:jenkins-core (Maven): 2.138.4, 2.154Red Hat: 1 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.jenkins-ci.main:jenkins-core (Maven)before 2.138.42.138.4Patch availableGHSA-hhpm-5cp2-hg4x
—org.jenkins-ci.main:jenkins-core (Maven)2.140 to before 2.1542.154Patch availableGHSA-hhpm-5cp2-hg4x
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 2.138.4 Fixed in 2.138.4 Patch available GHSA-hhpm-5cp2-hg4x
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.140 to before 2.154 Fixed in 2.154 Patch available GHSA-hhpm-5cp2-hg4x

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*up to 2.138.3VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*up to 2.153VulnerableJenkins
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*3.11VulnerableRed Hat
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions up to 2.138.3 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* Versions up to 2.153 Vulnerable ·Jenkins
  • cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-hhpm-5cp2-hg4x org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.138.4 Advisory →
  • Fix · GHSA-hhpm-5cp2-hg4x org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.154 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.10AffectedNo fix yet
Red Hat OpenShift Container Platform 3.2AffectedNo fix yet
Red Hat OpenShift Container Platform 3.3AffectedNo fix yet
Red Hat OpenShift Container Platform 3.4AffectedNo fix yet
Red Hat OpenShift Container Platform 3.5AffectedNo fix yet
Red Hat OpenShift Container Platform 3.6AffectedNo fix yet
Red Hat OpenShift Container Platform 3.7AffectedNo fix yet
Red Hat OpenShift Container Platform 3.9AffectedNo fix yet
Red Hat OpenShift Container Platform 3.11Fixed—
Not affected: 1 product
  • Red Hat OpenShift Container Platform 3.11

Timeline

  1. 2022-02-10 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2018-1000861
  3. 2026-10-03 Alias added: GHSA-hhpm-5cp2-hg4x

References

Advisory 4

Other 2

  • TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2015-04472 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote… KEVCVSS 3.1HIGH 7.5
  • TI-2016-07596 The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers… CVSS 3.0CRITICAL 9.8
  • TI-2015-06740 The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote… CVSS 3.1CRITICAL 9.8
See all 293 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences