Description
A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful (200) or not.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.107.3 | 2.107.3 | GHSA-rgmj-mccj-h9mx |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.108, < 2.121 | 2.121 | GHSA-rgmj-mccj-h9mx |