Description
A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that allows attackers with Overall/Read permission to submit a GET request to an attacker-specified URL.
Remediation
References
https://jenkins.io/security/advisory/2019-01-28/#SECURITY-818
Related Vulnerabilities
CVE-2019-10353 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2017-12174 Vulnerability in maven package org.apache.activemq:artemis-core-client
CVE-2021-21349 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2012-6662 Vulnerability in maven package org.fujion.webjars:jquery-ui
CVE-2022-23712 Vulnerability in maven package org.elasticsearch:elasticsearch