Security readout for executives and security teams
Plain-English summary
This Jenkins issue lets someone who already has basic Overall/Read access see the full list of installed plugins. That does not directly mean system compromise, but plugin inventory can reveal weak or outdated components and help an attacker choose follow-on targets.
Executive priority
Treat this as a moderate-priority Jenkins hardening issue. It is not documented here as direct remote code execution, but it can materially improve attacker reconnaissance against CI/CD infrastructure, which often has sensitive build and deployment access.
Technical view
CVE-2018-1000192 affects Jenkins 2.120 and older, and Jenkins LTS 2.107.2 and older. The cited components are AboutJenkins.java and ListPluginsCommand.java. Users with Overall/Read can enumerate installed plugins. The source bundle provides no CVSS, CWE, or confirmed exploit activity.
Likely exposure
Exposure is limited to Jenkins instances on affected versions where untrusted or broadly provisioned users have Overall/Read permission. Risk is higher for internet-facing Jenkins or environments with many contractors, vendors, or shared read-only accounts.
Exploitation context
The bundle does not show KEV listing or active exploitation. The likely security impact is reconnaissance: plugin names and versions can help attackers identify vulnerable Jenkins extensions or plan social engineering and follow-on attacks.
Researcher notes
Evidence is narrow: affected versions, permission requirement, and plugin enumeration are documented, but the bundle lacks CVSS, CWE, exploit details, and explicit patch text. Avoid expanding scope beyond Jenkins core behavior described by SECURITY-771.
Mitigation direction
- Review the Jenkins advisory for the vendor-confirmed fixed versions and upgrade path.
- Reduce Overall/Read access to trusted users who need Jenkins visibility.
- Audit shared, vendor, contractor, and stale Jenkins accounts.
- Restrict network access to Jenkins administration surfaces where possible.
- Review plugin hygiene after remediation, especially outdated or unused plugins.
Validation and detection
- Identify Jenkins instances running 2.120 or older, or LTS 2.107.2 or older.
- Review which users and groups have Overall/Read permission.
- Confirm whether read-only users can view plugin inventory through normal Jenkins interfaces.
- Compare remediation status against the Jenkins SECURITY-771 advisory.
- Document exposed instances and prioritize internet-facing or broadly accessible systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-1000192 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpuapr2022.htmlCVE reference · x_refsource_MISC
- https://jenkins.io/security/advisory/2018-05-09/#SECURITY-771CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.