CVE-2018-1000111 Jenkins Subversion Plugin Incorrect Authorization vulnerability
An attacker with network access can obtain a list of nodes and users due to improper authorization in the Jenkins Subversion Plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000111?
CVE-2018-1000111 is a medium-severity missing authorization vulnerability in n/a, published on 13 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and SubversionRepositoryStatus.java that allows an attacker with network access to obtain a list of nodes and users.
Weakness: CWE-863
Which versions are affected by CVE-2018-1000111?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:subversion. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:subversion Maven | All versions | 2.10.3 |
org.jenkins-ci.plugins:subversion Maven | All versions | 2.10.3 |
Products include Jenkins Subversion.
How do I fix CVE-2018-1000111?
Upgrade org.jenkins-ci.plugins:subversion to 2.10.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-1000111 being exploited?
There is no known exploitation of CVE-2018-1000111 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-21698 Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files
- CVE-2020-2304 XXE vulnerability in Jenkins Subversion Plugin
- CVE-2017-1000085 Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability
- CVE-2020-2111 Subversion Plugin stored XSS vulnerability
Sources
Also known as GHSA-w9gq-8q35-3jcc.