Description

A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.

Remediation

References

CVE-2018-1999042

Related Vulnerabilities

WordPress Plugin Rockhoist Ratings SQL Injection (1.2.1)

WordPress Plugin Newsletter Subscription Form Possible Remote Code Execution (1.1.2)

WordPress Plugin VKontakte API Cross-Site Scripting (2.7)

WordPress Plugin Estatik Real Estate Cross-Site Request Forgery (3.8.3)

Drupal Core 9.3.x Cross-Site Scripting (9.3.0 - 9.3.18)

Severity

Medium

Classification

CVE-2018-1999042 CWE-502 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities