GitHub Advisoryadvisory · Maven

GHSA-278v-j3cr-jv2x Jenkins Kanboard Plugin vulnerable to Server-side request forgery (SSRF)

MEDIUM Published 2022-05-13 Modified 2024-01-30 Official page ↗
Aliases
CVE-2019-1003020
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:kanboard
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-918
Reviewed
2024-01-30

Affected packages

• Maven org.jenkins-ci.plugins:kanboard: < 1.5.11 → fixed in 1.5.11

Description

A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that allows attackers with Overall/Read permission to submit a GET request to an attacker-specified URL.

Related

Alias · CVE (1)

  • CVE-2019-1003020 A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References