CVE-2018-1000195: CSRF
A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful (200) or not.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000195?
CVE-2018-1000195 has a medium severity rating as it allows attackers to exploit server-side request forgery.
How do I fix CVE-2018-1000195?
To fix CVE-2018-1000195, upgrade to Jenkins version 2.121 or later and LTS version 2.107.3 or later.
Who is affected by CVE-2018-1000195?
CVE-2018-1000195 affects Jenkins versions up to 2.120 and LTS versions up to 2.107.2, as well as Oracle Communications Cloud Native Core Automated Test Suite version 1.9.0.
What kind of attack can be executed using CVE-2018-1000195?
CVE-2018-1000195 allows attackers with Overall/Read permission in Jenkins to carry out a server-side request forgery attack.
What are the consequences of exploiting CVE-2018-1000195?
Exploiting CVE-2018-1000195 can lead to unauthorized access to internal resources and potential data leakage.