Description

A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

Remediation

References

https://jenkins.io/security/advisory/2018-06-04/#SECURITY-806

Related Vulnerabilities

CVE-2023-40037 Vulnerability in maven package org.apache.nifi:nifi-dbcp-base

CVE-2019-10249 Vulnerability in maven package org.eclipse.xtext:org.eclipse.xtext.maven.parent

CVE-2015-6524 Vulnerability in maven package org.apache.activemq:activemq-all

CVE-2019-10419 Vulnerability in maven package org.jenkins-ci.plugins:application-director-plugin

CVE-2021-28128 Vulnerability in npm package strapi

Severity

Medium

Classification

CWE-918 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Vendor Advisory