URLTrigger Plugin server-side request forgery vulnerability

2022-05-1403:05:26

Google

osv.dev

0.001 Low

EPSS

Percentile

22.0%

JSON

A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. As of version 0.43, this form validation method no longer connects to a user provided URL.

CPENameOperatorVersion
org.jenkins-ci.plugins:urltriggereq0.21
org.jenkins-ci.plugins:urltriggereq0.14
org.jenkins-ci.plugins:urltriggereq0.33
org.jenkins-ci.plugins:urltriggereq0.19
org.jenkins-ci.plugins:urltriggereq0.4.2
org.jenkins-ci.plugins:urltriggereq0.35
org.jenkins-ci.plugins:urltriggereq0.10
org.jenkins-ci.plugins:urltriggereq0.38
org.jenkins-ci.plugins:urltriggereq0.36
org.jenkins-ci.plugins:urltriggereq0.18

Name	Operator	Version
org.jenkins-ci.plugins:urltrigger	eq	0.21
org.jenkins-ci.plugins:urltrigger	eq	0.14
org.jenkins-ci.plugins:urltrigger	eq	0.33
org.jenkins-ci.plugins:urltrigger	eq	0.19
org.jenkins-ci.plugins:urltrigger	eq	0.4.2
org.jenkins-ci.plugins:urltrigger	eq	0.35
org.jenkins-ci.plugins:urltrigger	eq	0.10
org.jenkins-ci.plugins:urltrigger	eq	0.38
org.jenkins-ci.plugins:urltrigger	eq	0.36
org.jenkins-ci.plugins:urltrigger	eq	0.18