Select Page

[Overview]

Jenkins is an open source, continuous integration and delivery application based on Java development that runs in a Servlet container. Jenkins allows developers to automate the build process using Apache Ant, Apache Maven, and Shell scripts, allowing developers to focus more on business implementation.

[Vulnerability Details]

CVE-2018-1999001: The vulnerability is caused by the getOrCreate() function not properly validating the login request. An unauthorized attacker could exploit this vulnerability by constructing a malicious login credential and moving the config.xml configuration file from the Jenkins home directory to another directory. If the vulnerability is exploited, it will cause the Jenkins service to revert to the old default configuration when it restarts, thus opening administrator privileges to anonymous users.

Vulnerability Source: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1999001

[Severity]

High

[Affected Versions]

  • Jenkins Jenkins LTS 2.121.1 and prior
  • Jenkins Jenkins weekly 2.132 and prior

[Suggestions]

Update the bug fix release provided by Jenkins to eliminate the damage caused by the vulnerability.

Official statement: https://jenkins.io/security/advisory/2018-07-18/#SECURITY-897

[Hillstone Networks Solution]

Hillstone Networks has added signatures to the IPS signature database version 2.1.251. By deploying any Hillstone Networks solution with the IPS function, the Jenkins CI Server getOrCreate Policy Bypass vulnerability can be quickly detected and effectively intercepted, preventing the server from being attacked.

Threat Events Detected by Hillstone Solutions

Vulnerability Detail Description

Hillstone NGFWs Recognized for 8th Straight Year in Gartner® Magic Quadrant™, Named as a “Visionary”

Hillstone Networks Wins 2021 CybersecAsia Readers’ Choice Award

ZTNA: A Better Way to Control Access, Boost Security

Hillstone sBDS V3.4 Extends Supplementary Detection Capabilities

Kudos to the Hillstone Security Research Team for Being Acknowledge by Microsoft for Vulnerability Discovery

Hillstone Releases iSource, an Extended Detection and Response Platform

Hillstone’s A200W streamlines deployment of cost-effective perimeter solution

Endpoint Detection and Response: Getting from Good to Great

ADC V2.9 delivers traffic and balances links at an unprecedented level