Description

A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/12/17/1

https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1681

Related Vulnerabilities

CVE-2020-11620 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2021-4040 Vulnerability in maven package org.apache.activemq:artemis-commons

CVE-2020-17510 Vulnerability in maven package org.apache.shiro:shiro-spring-boot-web-starter

CVE-2021-32803 Vulnerability in npm package tar

CVE-2023-36479 Vulnerability in maven package org.eclipse.jetty.ee9:jetty-ee9-servlets

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory CWE-352