Security readout for executives and security teams
Plain-English summary
Jenkins Copy To Slave Plugin 1.4.4 and older can let a user who is allowed to configure jobs read files from the Jenkins master file system. This matters because Jenkins masters often hold credentials, keys, build secrets, and operational configuration.
Executive priority
Treat this as high priority if Jenkins job configuration rights are broadly delegated. The issue can expose sensitive CI infrastructure data, but evidence provided does not show active exploitation or KEV status.
Technical view
The vulnerability is in CopyToSlaveBuildWrapper.java. The CVE states that attackers with job configuration permission can read arbitrary files from the Jenkins master file system through affected Copy To Slave Plugin versions 1.4.4 and older.
Likely exposure
Exposure is limited to Jenkins environments using Copy To Slave Plugin 1.4.4 or older where untrusted or broad groups have job configuration rights.
Exploitation context
The provided sources do not show KEV listing or active exploitation. Abuse requires Jenkins access with permission to configure jobs, so the main risk is insider, compromised developer, or over-permissioned CI account misuse.
Researcher notes
The public bundle does not include CVSS, CWE, CPE, or detailed fixed-version data. Analysis is based on the CVE description and Jenkins advisory reference only; verify exact remediation from Jenkins source material.
Mitigation direction
- Inventory Jenkins instances for Copy To Slave Plugin usage and version.
- Review Jenkins advisory SECURITY-545 for vendor remediation guidance.
- Restrict job configuration permissions to trusted administrators only.
- Disable or remove the plugin if it is unnecessary or cannot be safely remediated.
- Review Jenkins master filesystem secrets and credential exposure assumptions.
Validation and detection
- Check installed Jenkins plugins for Copy To Slave Plugin version 1.4.4 or older.
- Review job configuration permission assignments for users, groups, and service accounts.
- Look for jobs using Copy To Slave Plugin build wrapper behavior.
- Review Jenkins audit logs for unusual job configuration changes.
- Confirm remediation against the Jenkins SECURITY-545 advisory.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-1000148 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://jenkins.io/security/advisory/2018-03-26/#SECURITY-545CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.