CVE-2018-1000193

EUVD-2022-2922 · Published May 13, 2022

Injection in Jenkins A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and cannot be deleted via the UI.

Technologies

Jenkins JenkinsOracle Communications Cloud Native Core Automated Test Suite

Weaknesses

CWE-74

CVSS scores

v3.04.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Execution Stealth Defense Impairment

T1190Exploit Public-Facing Application T1027Obfuscated Files or Information T1574.006Dynamic Linker Hijacking T1574.007Path Interception by PATH Environment Variable T1690Prevent Command History Logging

References

https://jenkins.io/security/advisory/2018-05-09/#SECURITY-786
https://www.oracle.com/security-alerts/cpuapr2022.html
https://nvd.nist.gov/vuln/detail/CVE-2018-1000193
https://github.com/jenkinsci/jenkins/commit/de7aaab441151fb1760855fec83681c6a8756a45
https://github.com/jenkinsci/jenkins

Potentially impacted assets

See if this affects your attack surface