CVE-2018-1000068

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-02-16 · updated 2026-06-17
Weakness: CWE-200

Description

An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitive file system.

Affected products

Jenkins: through 2.106; through 2.89.3
Oracle Communications Cloud Native Core Automated Test Suite: 1.9.0

References

http://www.securityfocus.com/bid/103101
https://jenkins.io/security/advisory/2018-02-14/#SECURITY-717
https://www.oracle.com/security-alerts/cpuapr2022.html
http://www.securityfocus.com/bid/103101
https://jenkins.io/security/advisory/2018-02-14/#SECURITY-717
https://www.oracle.com/security-alerts/cpuapr2022.html

Get alerted when CVE-2018-1000068 or the next vulnerability affects your stack