User Impersonation Affecting org.jenkins-ci.main:jenkins-core package, versions [,2.107.3) [2.120,2.121)
Threat Intelligence
EPSS
0.05% (23rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIMAIN-32370
- published 13 Jun 2018
- disclosed 26 Apr 2018
- credit Sureshbabu Narvaneni
Introduced: 26 Apr 2018
CVE-2018-1000193 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.main:jenkins-core to versions 2.107.3, 2.121 or higher.
Overview
org.jenkins-ci.main:jenkins-core is an open source automation server.
Affected versions of this package are vulnerable to User Impersonation via the HudsonPrivateSecurityRealm.java method. A malicious user could sign up using user names containing control characters that can then appear to have the same name as other users, and cannot be deleted via the UI.
References
CVSS Scores
version 3.1