Description

A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

Remediation

References

https://jenkins.io/security/advisory/2018-06-25/#SECURITY-819

Related Vulnerabilities

CVE-2022-39975 Vulnerability in maven package com.liferay.portal:release.portal.bom

CVE-2022-41227 Vulnerability in maven package io.jenkins.plugins:cavisson-ns-nd-integration

CVE-2023-50732 Vulnerability in maven package org.xwiki.platform:xwiki-platform-index-tree-macro

CVE-2023-20873 Vulnerability in maven package org.springframework.boot:spring-boot-actuator-autoconfigure

CVE-2022-39202 Vulnerability in npm package matrix-appservice-irc

Severity

High

Classification

CWE-918 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Tags

Vendor Advisory