GHSA-rgmj-mccj-h9mx
Cross-Site Request Forgery in Jenkins
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.107.3 | 2.107.3 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.108, < 2.121 | 2.121 |
Details
As written in the advisory (Markdown source, shown as plain text).
A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful (200) or not.
References
External links from the advisory. They lead to third-party sites.