Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02bXY5LWhjeDUtN21oaM3mmQ

Server-Side Request Forgery in Jenkins

An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response.

Permalink: https://github.com/advisories/GHSA-6mv9-hcx5-7mhh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02bXY5LWhjeDUtN21oaM3mmQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: almost 2 years ago

CVSS Score: 5.3
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Percentage: 0.00091
EPSS Percentile: 0.40506

Identifiers: GHSA-6mv9-hcx5-7mhh, CVE-2018-1000067
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000067
• https://jenkins.io/security/advisory/2018-02-14/#SECURITY-506
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://github.com/jenkinsci/jenkins/commit/2d16b459205730d85e51499c2457109b234ca9d9
• https://github.com/advisories/GHSA-6mv9-hcx5-7mhh

Repository: https://github.com/jenkinsci/jenkins
Blast Radius: 1.0

Affected Packages