CVE-2018-1000861

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/106176Broken Link
https://access.redhat.com/errata/RHBA-2019:0024Third Party Advisory
https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595Vendor Advisory
http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/106176Broken Link
https://access.redhat.com/errata/RHBA-2019:0024Third Party Advisory
https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1000861US Government Resource

Timeline

Published: Dec 10, 2018
Last modified: Jun 17, 2026
Added to CISA KEV: Feb 10, 2022
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-10008624.3An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allo CVE-2018-10008638.2A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows att CVE-2018-10008646.5A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Ov CVE-2018-10008658.8A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/CVE-2018-10008668.8A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox CVE-2018-10008678.8WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions*.php scripts that can result in Da CVE-2018-10008686.1WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user_login.php, register.php that can resul CVE-2018-10008699.8phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. This attack a CVE-2018-10008705.4PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the CVE-2018-10008719.8HotelDruid HotelDruid 2.3.0 version 2.3.0 and earlier contains a SQL Injection vulnerability in "id_utente_mod" parameter in gestione_utenti CVE-2018-10008726.5OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerabil CVE-2018-10008736.5Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result i