Server-side request forgery (SSRF) In org.jenkins-ci.plugins:github-branch-source
Description
Jenkins GitHub Branch Source Plugin vulnerable to Server-Side Request Forgery A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. As of version 23.5, this form validation method requires POST requests and the Overall/Administer permission.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 2.3.5 |
Aliases
1. 2. 3. 4.
References
1. 2.