{"id":"GHSA-9cfq-v2hm-c3xr","summary":"Jenkins GitHub Branch Source Plugin vulnerable to Server-Side Request Forgery","details":"A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. As of version 23.5, this form validation method requires POST requests and the Overall/Administer permission.","aliases":["CVE-2018-1000185"],"modified":"2024-02-16T08:22:11.710511Z","published":"2022-05-14T03:13:13Z","database_specific":{"cwe_ids":["CWE-918"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2022-12-12T16:49:32Z","nvd_published_at":"2018-06-05T20:29:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000185"},{"type":"WEB","url":"https://github.com/jenkinsci/github-branch-source-plugin/commit/22d3383002274bc3f4368534eba2b5c852e78b39"},{"type":"PACKAGE","url":"https://github.com/jenkinsci/github-branch-source-plugin"},{"type":"WEB","url":"https://jenkins.io/security/advisory/2018-06-04/#SECURITY-806"}],"affected":[{"package":{"name":"org.jenkins-ci.plugins:github-branch-source","ecosystem":"Maven","purl":"pkg:maven/org.jenkins-ci.plugins/github-branch-source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.5"}]}],"versions":["0.1-beta-1","0.1-beta-2","0.1-beta-3","0.1-beta-4","1.0","1.1","1.10","1.10.1","1.2","1.3","1.4","1.4-beta-1","1.5","1.6","1.7","1.8","1.8.1","1.9","2.0.0","2.0.0-beta-1","2.0.0-beta-2","2.0.1","2.0.1-beta-1","2.0.1-beta-2","2.0.1-beta-3","2.0.1-beta-4","2.0.1-beta-5","2.0.1-beta-6","2.0.2","2.0.3","2.0.4","2.0.4-beta-1","2.0.5","2.0.6","2.0.7","2.0.8","2.2.0","2.2.0-alpha-1","2.2.0-alpha-2","2.2.0-alpha-3","2.2.0-alpha-4","2.2.0-beta-1","2.2.0-beta-2","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4"],"database_specific":{"last_known_affected_version_range":"\u003c= 2.3.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9cfq-v2hm-c3xr/GHSA-9cfq-v2hm-c3xr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}]}