Server-Side Request Forgery in Jenkins GitHub Branch Source Plugin
CVE-2018-1000185

4.3MEDIUM

Key Information:

Vendor
Jenkins
Status
Github Branch Source
Vendor
CVE Published:
5 June 2018

Summary

A server-side request forgery (SSRF) vulnerability exists in the Jenkins GitHub Branch Source Plugin version 2.3.4 and earlier. This flaw permits authenticated users with Overall/Read permissions to manipulate Jenkins into sending GET requests to arbitrary URLs. This can lead to unauthorized access to internal services or sensitive information, thus highlighting the need for timely security updates and monitoring of plugin configurations.

References

https://jenkins.io/security/advisory/2018-06-04/#SECURITY...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.