CVE-2018-1000195

MEDIUM

Jenkins < 2.120 and LTS < 2.107.2 - Server-Side Request Forgery via ZipExtractionInstaller

Title source: llm

Description

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful (200) or not.

References (2)

Core 2

Core References

Patch, Third Party Advisory x_refsource_misc

https://www.oracle.com/security-alerts/cpuapr2022.html

Vendor Advisory x_refsource_confirm

https://jenkins.io/security/advisory/2018-05-09/#SECURITY-794

Scores

CVSS v3 4.3

EPSS 0.0069

EPSS Percentile 72.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Details

CWE

CWE-352

Status published

Products (4)

jenkins/jenkins < 2.107.2

jenkins/jenkins < 2.120

oracle/communications_cloud_native_core_automated_test_suite 1.9.0

org.jenkins-ci.main/jenkins-core 0 - 2.107.3Maven

Published Jun 05, 2018

Tracked Since Feb 18, 2026