GitHub Advisoryadvisory · Maven

GHSA-6mv9-hcx5-7mhh Server-Side Request Forgery in Jenkins

MEDIUM Published 2022-05-13 Modified 2022-06-30 Official page ↗
Aliases
CVE-2018-1000067
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-918
Reviewed
2022-06-30

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.89.4 → fixed in 2.89.4 • Maven org.jenkins-ci.main:jenkins-core: >= 2.90, < 2.107 → fixed in 2.107

Description

An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response.

Related

Alias · CVE (1)

  • CVE-2018-1000067 An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References