Description
A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Remediation
References
https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3118
Related Vulnerabilities
CVE-2019-1003099 Vulnerability in maven package org.jenkins-ci.plugins:openid
CVE-2019-10371 Vulnerability in maven package org.jenkins-ci.plugins:gitlab-oauth
CVE-2021-21341 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2023-26472 Vulnerability in maven package org.xwiki.platform:xwiki-platform-icon-ui
CVE-2019-10359 Vulnerability in maven package org.jenkins-ci.plugins.m2release:m2release