Description

A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

Remediation

References

https://jenkins.io/security/advisory/2018-06-04/#SECURITY-806

Related Vulnerabilities

CVE-2022-41232 Vulnerability in maven package org.jenkins-ci.plugins:build-publisher

CVE-2020-24590 Vulnerability in maven package org.wso2.carbon.governance:org.wso2.carbon.governance.generic

CVE-2017-15703 Vulnerability in maven package org.apache.nifi:nifi-web-api

CVE-2012-0022 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2010-2076 Vulnerability in maven package org.apache.cxf:cxf-bundle-minimal

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Vendor Advisory CWE-918