~ / search / GHSA-53wf-vqf9-cgf2

GHSA-53wf-vqf9-cgf2

Server-Side Request Forgery in Jenkins Git Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000182

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:git < 3.9.1 3.9.1

Details

As written in the advisory (Markdown source, shown as plain text).

A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2013GitRepositoryBrowser.java, ViewGitWeb.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

References

External links from the advisory. They lead to third-party sites.