CVE-2018-1000058

Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deserialization like readResolve implemented in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.

• CWE-502

• http://www.securityfocus.com/bid/103034Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2018-02-05/Vendor Advisory
• http://www.securityfocus.com/bid/103034Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2018-02-05/Vendor Advisory

Published

Feb 9, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000052fmtlib version prior to version 4.1.0 (before commit 0555cea…7.5
• CVE-2018-1000053LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite R…
• CVE-2018-1000054Jenkins CCM Plugin 3.1 and earlier processes XML external en…
• CVE-2018-1000055Jenkins Android Lint Plugin 2.5 and earlier processes XML ex…
• CVE-2018-1000056Jenkins JUnit Plugin 1.23 and earlier processes XML external…
• CVE-2018-1000057Jenkins Credentials Binding Plugin 1.14 and earlier masks pa…
• CVE-2018-1000059ValidFormBuilder version 4.5.4 contains a PHP Object Injecti…
• CVE-2018-1000060Sensu, Inc. Sensu Core version Before 1.2.0 & before commit …
• CVE-2018-1000061Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1000062WonderCMS version 2.4.0 contains a Stored Cross-Site Scripti…
• CVE-2018-1000063Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1000064Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…