CVE-2018-1000185 - jenkins-plugin-github-branch-source: Server-side request forgery vulnerability (SECURITY-806)

Back Back to CVE browser

MEDIUM

jenkins-plugin-github-branch-source: Server-side request forgery vulnerability (SECURITY-806)

Published Jun 5, 2018

5.0

MEDIUM

CVSS 3.0

EPSS 0.64%

Description

A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

Affected products

Product	Package	State	Advisory
Red Hat OpenShift Enterprise 3	jenkins-plugin-github-branch-source	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (8)

https://access.redhat.com/security/cve/CVE-2018-1000185
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1585994
Issue Tracking
https://github.com/advisories/GHSA-9cfq-v2hm-c3xr
Advisory
https://github.com/jenkinsci/github-branch-source-plugin/commit/22d3383002274bc3f4368534eba2b5c852e78b39
https://jenkins.io/security/advisory/2018-06-04/
https://jenkins.io/security/advisory/2018-06-04/#SECURITY-806
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000185
https://www.cve.org/CVERecord?id=CVE-2018-1000185

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2018-1000185		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1585994		Issue Tracking
https://github.com/advisories/GHSA-9cfq-v2hm-c3xr		Advisory
https://github.com/jenkinsci/github-branch-source-plugin/commit/22d3383002274bc3f4368534eba2b5c852e78b39
https://jenkins.io/security/advisory/2018-06-04/
https://jenkins.io/security/advisory/2018-06-04/#SECURITY-806		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000185
https://www.cve.org/CVERecord?id=CVE-2018-1000185