GitHub Advisoryadvisory · Maven

GHSA-wxj2-qc9p-65r3 Jenkins Mattermost Notification Plugin vulnerable to SSRF

MEDIUM Published 2022-05-13 Modified 2024-01-30 Official page ↗
Aliases
CVE-2019-1003026
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:mattermost
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-918
Reviewed
2024-01-30

Affected packages

• Maven org.jenkins-ci.plugins:mattermost: < 2.6.3 → fixed in 2.6.3

Description

A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and room and send a message.

Related

Alias · CVE (1)

  • CVE-2019-1003026 A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References