CVE-2018-1000182 — Server-Side Request Forgery in Jenkins GIT

CWE-918 — Server-Side Request ForgeryCWE-352 — Cross-Site Request Forgery8 documents8 sources
Severity
6.4MEDIUMNVD
EPSS
0.0%
top 88.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Jenkins GIT
Timeline
PublishedJun 5
Latest updateMay 14

Description

A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2013GitRepositoryBrowser.java, ViewGitWeb.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NExploitability: 3.1 | Impact: 2.7

Affected Packages1 packages

▶NVDjenkins/git3.9.0

🔴Vulnerability Details

3
OSV
Server-Side Request Forgery in Jenkins Git Plugin↗2022-05-14
▶
GHSA
Server-Side Request Forgery in Jenkins Git Plugin↗2022-05-14
▶
CVEList
CVE-2018-1000182: A server-side request forgery vulnerability exists in Jenkins Git Plugin 3↗2018-06-05
▶

📋Vendor Advisories

3
Microsoft
A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2013GitRepositoryBrowser.java, ViewGitWeb.↗2018-06-12
▶
Jenkins
Jenkins Security Advisory 2018-06-04↗2018-06-04
▶
Red Hat
jenkins-plugin-git: Server-side request forgery vulnerability (SECURITY-810)↗2018-06-04
▶

💬Community

1
Bugzilla
CVE-2018-1000182 jenkins-plugin-git: Server-side request forgery vulnerability (SECURITY-810)↗2018-06-05
▶
CVE-2018-1000182 — Server-Side Request Forgery | cvebase