CVE-2018-1000863

Severity: high (CVSS 8.2 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-12-10 · updated 2026-06-17
Weakness: CWE-22

Description

A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.

Affected products

Jenkins: through 2.138.3; through 2.153
Red Hat OpenShift Container Platform 4.18: 3.11

References

http://www.securityfocus.com/bid/106176
https://access.redhat.com/errata/RHBA-2019:0024
https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072
https://www.tenable.com/security/research/tra-2018-43
http://www.securityfocus.com/bid/106176
https://access.redhat.com/errata/RHBA-2019:0024
https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072
https://www.tenable.com/security/research/tra-2018-43

Get alerted when CVE-2018-1000863 or the next vulnerability affects your stack