{"id":"CVE-2018-1999038","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-1999038","generatedAt":"2026-10-28T21:32:06.686Z","title":"A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials.","description":"A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials.","published":"2018-08-01T13:29:01.000Z","lastModified":"2026-06-17T01:48:23.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":4.2,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-441"],"affected":["jenkins/publish over cifs"],"epss":{"score":0.00483,"percentile":0.41449,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.48%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://jenkins.io/security/advisory/2018-07-30/#SECURITY-975","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://jenkins.io/security/advisory/2018-07-30/#SECURITY-975","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-1999038","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}