GHSA-hp7x-282p-hhr9

Jenkins TraceTronic ECU-TEST Plugin server-side request forgery vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1999026

Packages

Ecosystem	Package	Affected	Fixed in
Maven	de.tracetronic.jenkins.plugins:ecutest	< 2.4	2.4

Details

As written in the advisory (Markdown source, shown as plain text).

A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Jenkins send HTTP requests to an attacker-specified host.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1999026 advisory
https://github.com/jenkinsci/ecutest-plugin/commit/943c4d3c8df521eb94fb99429717e3920c6fc7f7 web
https://github.com/jenkinsci/ecutest-plugin package
https://jenkins.io/security/advisory/2018-07-30/#SECURITY-994 web
https://web.archive.org/web/20200227115310/http://www.securityfocus.com/bid/104960 web