Jenkins Crowd 2 Integration Plugin server-side request forgery vulnerability

2022-05-1401:38:17

Google

osv.dev

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have Jenkins perform a connection test, connecting to an attacker-specified server with attacker-specified credentials and connection settings.

CPENameOperatorVersion
org.jenkins-ci.plugins:crowd2eq1.2
org.jenkins-ci.plugins:crowd2eq1.7
org.jenkins-ci.plugins:crowd2eq2.0.0-beta3
org.jenkins-ci.plugins:crowd2eq1.4
org.jenkins-ci.plugins:crowd2eq1.8
org.jenkins-ci.plugins:crowd2eq2.0.0-beta2
org.jenkins-ci.plugins:crowd2eq2.0.0
org.jenkins-ci.plugins:crowd2eq2.0.0-beta1
org.jenkins-ci.plugins:crowd2eq1.0
org.jenkins-ci.plugins:crowd2eq1.3

Name	Operator	Version
org.jenkins-ci.plugins:crowd2	eq	1.2
org.jenkins-ci.plugins:crowd2	eq	1.7
org.jenkins-ci.plugins:crowd2	eq	2.0.0-beta3
org.jenkins-ci.plugins:crowd2	eq	1.4
org.jenkins-ci.plugins:crowd2	eq	1.8
org.jenkins-ci.plugins:crowd2	eq	2.0.0-beta2
org.jenkins-ci.plugins:crowd2	eq	2.0.0
org.jenkins-ci.plugins:crowd2	eq	2.0.0-beta1
org.jenkins-ci.plugins:crowd2	eq	1.0
org.jenkins-ci.plugins:crowd2	eq	1.3