Description

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful (200) or not.

Remediation

References

CVE-2018-1000195

Related Vulnerabilities

Jetty Uncontrolled Resource Consumption Vulnerability (CVE-2022-2048)

OpenSSL Cryptographic Issues Vulnerability (CVE-2016-0800)

WordPress Plugin Heat Trackr Cross-Site Scripting (1.0)

WordPress Plugin Appointment Booking Calendar Multiple Vulnerabilities (1.1.24)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-5583)

Severity

Medium

Classification

CVE-2018-1000195 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities