Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02bXY5LWhjeDUtN21oaM3mmQ

Server-Side Request Forgery in Jenkins

An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response.

Permalink: https://github.com/advisories/GHSA-6mv9-hcx5-7mhh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02bXY5LWhjeDUtN21oaM3mmQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago

CVSS Score: 5.3
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-6mv9-hcx5-7mhh, CVE-2018-1000067
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000067
• https://jenkins.io/security/advisory/2018-02-14/#SECURITY-506
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://github.com/jenkinsci/jenkins/commit/2d16b459205730d85e51499c2457109b234ca9d9
• https://github.com/advisories/GHSA-6mv9-hcx5-7mhh

Repository: https://github.com/jenkinsci/jenkins
Blast Radius: 1.0

Affected Packages