CVE-2018-1000152

CVE-2018-1000152 describes an improper authorization vulnerability in Jenkins vSphere Plugin versions 2.16 and older, impacting various functionalities within the plugin. This flaw allows authenticated attackers to perform form validation actions, potentially leading to denial of service against the vSphere server by sending numerous requests, or to exfiltrate Jenkins-stored credentials to an attacker-controlled server via a "test connection" feature. With a CVSS score of 6.3 (Medium), the vulnerability has a network attack vector and low attack complexity, requiring low privileges to exploit, and can result in partial impacts to confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.