What is GHSA-rv87-vcv4-fjvr?

GHSA-rv87-vcv4-fjvr is a security advisory published by GitHub Security Advisories with Medium severity. URLTrigger Plugin server-side request forgery vulnerability

Which CVE IDs does GHSA-rv87-vcv4-fjvr cover?

GHSA-rv87-vcv4-fjvr covers the following CVE IDs: CVE-2018-1000606. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rv87-vcv4-fjvr?

GHSA-rv87-vcv4-fjvr has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-rv87-vcv4-fjvr?

GHSA-rv87-vcv4-fjvr affects 1 product, including: maven/org.jenkins-ci.plugins:urltrigger:\u003c= 0.41.

GHSA-rv87-vcv4-fjvrMediumCVSS 6.5

URLTrigger Plugin server-side request forgery vulnerability

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2018-1000606 →

📋 Description

A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. As of version 0.43, this form validation method no longer connects to a user provided URL.

🎯 Affected products1

maven/org.jenkins-ci.plugins:urltrigger:<= 0.41

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000606
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-819
https://github.com/jenkinsci/urltrigger-plugin/commit/46220e69c220bacf8eb23911c8feba9dd68d1a26
https://github.com/jenkinsci/urltrigger-plugin/commit/aec43e370550b26636aa9cab0f23a5cbcffdc44f
https://github.com/advisories/GHSA-rv87-vcv4-fjvr