Description
A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials.
Remediation
References
https://jenkins.io/security/advisory/2018-07-30/#SECURITY-975
Related Vulnerabilities
CVE-2022-41231 Vulnerability in maven package org.jenkins-ci.plugins:build-publisher
CVE-2018-1000197 Vulnerability in maven package com.blackducksoftware.integration:blackduck-hub
CVE-2023-33004 Vulnerability in maven package org.jenkins-ci.plugins:tag-profiler
CVE-2022-41251 Vulnerability in maven package org.jenkins-ci.plugins:apprenda
CVE-2015-0227 Vulnerability in maven package org.apache.ws.security:wss4j