Description

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful (200) or not.

Remediation

References

CVE-2018-1000195

Related Vulnerabilities

Magento Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2019-7889)

User Rights Access Manager Security Bypass (1.0.5)

Users Ultra Membership Multiple Vulnerabilities (1.5.62)

OpenSSL Cryptographic Issues Vulnerability (CVE-2014-3566)

GlassFish CVE-2012-3155 Vulnerability (CVE-2012-3155)

Severity

Medium

Classification

CVE-2018-1000195 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities