Security readout for executives and security teams
Plain-English summary
This issue lets a user with basic Jenkins read access run commands on the Jenkins master through the Absint Astree Plugin. That can threaten build infrastructure, credentials, and deployment pipelines. The source bundle does not provide a CVSS score or named patch details.
Executive priority
Treat this as high priority where the plugin is installed, especially on Jenkins systems tied to production deployment. Command execution on a Jenkins master can become a broader software supply-chain and credential exposure issue.
Technical view
CVE-2018-1000189 is a command execution flaw in AstreeBuilder.java affecting Jenkins Absint Astree Plugin 1.0.5 and older. The stated prerequisite is Overall/Read access. Successful exploitation allows command execution on the Jenkins master.
Likely exposure
Exposure is likely limited to Jenkins installations running Absint Astree Plugin 1.0.5 or older. Because the bundle lists affected vendor and product as n/a, confirm exposure through Jenkins plugin inventory rather than CPE matching.
Exploitation context
No provided source states active exploitation, and the bundle marks CISA KEV status as false. The key risk is post-authentication abuse: any account with Overall/Read access could potentially reach command execution on the Jenkins master.
Researcher notes
The source bundle is sparse: no CVSS, CWE, CPE, exploit status, or fix version is included. Analysis is grounded on the CVE description and Jenkins advisory reference only. Validate patch status directly against Jenkins SECURITY-807 before recommending a specific upgrade path.
Mitigation direction
- Inventory Jenkins controllers for Absint Astree Plugin 1.0.5 or older.
- Review Jenkins SECURITY-807 for vendor-provided remediation guidance.
- Restrict Jenkins Overall/Read access to trusted users only.
- Remove the plugin if it is not operationally required.
- Monitor Jenkins master hosts for unexpected command execution indicators.
Validation and detection
- Check Jenkins plugin inventory for Absint Astree Plugin version details.
- Review user and group assignments granting Overall/Read permission.
- Confirm whether Jenkins SECURITY-807 remediation has been applied.
- Search Jenkins audit and system logs for suspicious activity by read-only users.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-1000189 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://jenkins.io/security/advisory/2018-06-04/#SECURITY-807CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.