CVE-2018-1000195
05.06.2018, 21:29
A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful (200) or not.
| Vendor | Product | Version |
|---|---|---|
| jenkins | jenkins | 𝑥 ≤ 2.120 |
| jenkins | jenkins | 𝑥 ≤ 2.107.2 |
| oracle | communications_cloud_native_core_automated_test_suite | 1.9.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration