Description
A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials.
Remediation
References
https://jenkins.io/security/advisory/2018-07-30/#SECURITY-975
Related Vulnerabilities
CVE-2022-1438 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2013-2071 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2018-1000145 Vulnerability in maven package org.jvnet.hudson.plugins:perforce
CVE-2012-0394 Vulnerability in maven package org.apache.struts.xwork:xwork-core
CVE-2018-14042 Vulnerability in maven package org.webjars.npm:bootstrap-sass