CVE-2018-1000185

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-1000185

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000185.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-1000185

Aliases

GHSA-9cfq-v2hm-c3xr

Published

2018-06-05T20:29:00.513Z

Modified

2026-07-08T14:13:30.183746Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

[none]

Details

A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

References

https://jenkins.io/security/advisory/2018-06-04/#SECURITY-806

Affected packages

Git / github.com/jenkinsci/github-branch-source-plugin

Affected ranges

Type

GIT

Repo

https://github.com/jenkinsci/github-branch-source-plugin

Events

Introduced

Last affected

bc00bf7c309b832feadc5632b1348531ea6d63dc

Database specific

{
    "cpe": "cpe:2.3:a:jenkins:github_branch_source:*:*:*:*:*:jenkins:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.3.4"
        }
    ]
}

Affected versions

github-branch-source-0.*

github-branch-source-0.1-beta-1

github-branch-source-0.1-beta-2

github-branch-source-0.1-beta-3

github-branch-source-0.1-beta-4

github-branch-source-1.*

github-branch-source-1.0

github-branch-source-1.1

github-branch-source-1.10

github-branch-source-1.2

github-branch-source-1.3

github-branch-source-1.4

github-branch-source-1.4-beta-1

github-branch-source-1.5

github-branch-source-1.6

github-branch-source-1.7

github-branch-source-1.8

github-branch-source-1.8.1

github-branch-source-1.9

github-branch-source-2.*

github-branch-source-2.0.0

github-branch-source-2.0.0-beta-1

github-branch-source-2.0.0-beta-2

github-branch-source-2.0.1

github-branch-source-2.0.1-beta-1

github-branch-source-2.0.1-beta-2

github-branch-source-2.0.1-beta-3

github-branch-source-2.0.1-beta-4

github-branch-source-2.0.1-beta-5

github-branch-source-2.0.1-beta-6

github-branch-source-2.0.2

github-branch-source-2.0.3

github-branch-source-2.0.4

github-branch-source-2.0.4-beta-1

github-branch-source-2.0.5

github-branch-source-2.0.6

github-branch-source-2.0.7

github-branch-source-2.2.0

github-branch-source-2.2.0-beta-1

github-branch-source-2.2.0-beta-2

github-branch-source-2.2.1

github-branch-source-2.2.2

github-branch-source-2.2.3

github-branch-source-2.2.4

github-branch-source-2.2.5

github-branch-source-2.2.6

github-branch-source-2.3.0

github-branch-source-2.3.1

github-branch-source-2.3.2

github-branch-source-2.3.3

github-branch-source-2.3.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000185.json"