| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.main:jenkins-core | ≥ 2.108, < 2.121< 2.107.3 | 2.1212.107.3 |
| jenkins | ≤ 2.107.2≤ 2.120 | |
| communications cloud native core automated test suite | = 1.9.0 |
A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful (200) or not.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free