ZeroDay Findings
Sign inSign up

Findings

CVE-2018-1000861

Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability

Published Dec 10, 2018 · updated Jun 16, 2026 · jenkins jenkins

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 10, 2018 · Catalog

    Detected

    A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

  2. Feb 10, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Aug 10, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

Required action

Apply updates per vendor instructions.

CISA due date Aug 10, 2022

Affected

  • cpe jenkins/jenkinsversion unspecified
  • cpe redhat/openshift container platform3.11
  • vendor Jenkins Jenkins Stapler Web Frameworkversion unspecified

Sources

  • CISA KEVCVE-2018-1000861

    A code execution vulnerability exists in the Stapler web framework used by Jenkins

    cisa.gov
  • CVE.orgCVE-2018-1000861

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2018-1000861

    30-day exploitation probability 98.3%

    first.org
  • Metasploit Modulesexploit_multi/http/jenkins_metaprogramming

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2018-1000861

    A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs th

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References