medium4.3
CVE-2018-1000195
Cross-Site Request Forgery in Jenkins
Impact
A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful (200) or not.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.main:jenkins-core | <= 2.107.2 | 2.107.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Jenkins | through 2.120 through 2.107.2 |
| Oracle | Communications Cloud Native Core Automated Test Suite | Version 1.9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://jenkins.io/security/advisory/2018-05-09/#SECURITY-794
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://github.com/advisories/GHSA-rgmj-mccj-h9mx
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000195
- https://github.com/jenkinsci/jenkins/commit/6eea1e97840b5623829b2c1fd2e363c045bdc230