Jenkins GitHub Plugin server-side request forgery vulnerability exists

2022-05-1403:13:13

Google

osv.dev

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.2%

JSON

A server-side request forgery vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubPluginConfig.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

CPENameOperatorVersion
com.coravy.hudson.plugins.github:githubeq1.14.0-alpha-1
com.coravy.hudson.plugins.github:githubeq1.14.0-alpha-2
com.coravy.hudson.plugins.github:githubeq1.12.0
com.coravy.hudson.plugins.github:githubeq1.13.3
com.coravy.hudson.plugins.github:githubeq1.19.1
com.coravy.hudson.plugins.github:githubeq1.8
com.coravy.hudson.plugins.github:githubeq0.6
com.coravy.hudson.plugins.github:githubeq1.21.0
com.coravy.hudson.plugins.github:githubeq1.6
com.coravy.hudson.plugins.github:githubeq1.13.0

Name	Operator	Version
com.coravy.hudson.plugins.github:github	eq	1.14.0-alpha-1
com.coravy.hudson.plugins.github:github	eq	1.14.0-alpha-2
com.coravy.hudson.plugins.github:github	eq	1.12.0
com.coravy.hudson.plugins.github:github	eq	1.13.3
com.coravy.hudson.plugins.github:github	eq	1.19.1
com.coravy.hudson.plugins.github:github	eq	1.8
com.coravy.hudson.plugins.github:github	eq	0.6
com.coravy.hudson.plugins.github:github	eq	1.21.0
com.coravy.hudson.plugins.github:github	eq	1.6
com.coravy.hudson.plugins.github:github	eq	1.13.0