Improper Input Validation Affecting org.jenkins-ci.main:jenkins-core package, versions [,2.89.4]
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIMAIN-32159
- published 8 Apr 2018
- disclosed 14 Feb 2018
- credit Unknown
Introduced: 14 Feb 2018
CVE-2018-1000068 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.main:jenkins-core to version 2.89.4 or higher.
Overview
org.jenkins-ci.main:jenkins-core is an open-source automation server. Built with Java, it provides over 1000 plugins to support automating virtually anything, so that humans can actually spend their time doing things machines cannot.
Affected versions of this package are vulnerable to Improper Input Validation. It allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitive file system.