URLTrigger Plugin server-side request forgery vulnerability

MEDIUM 6.5CVE-2018-1000606 · GHSA-rv87-vcv4-fjvr · Published 26/06/2018 · updated 17/06/2026

In short

CVE-2018-1000606 is a MEDIUM (CVSS 6.5) vulnerability affecting org.jenkins-ci.plugins:urltrigger, urltrigger (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.70%, higher than 53.2% of all vulnerabilities.
Fix: update to 0.43 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:urltrigger Maven	`< 0.43`	`0.43`
urltrigger jenkins	`≤ 0.41`	No fix yet

Description

A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. As of version 0.43, this form validation method no longer connects to a user provided URL.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-1000606 · ADVISORY
jenkinsci/urltrigger-plugin commit 46220e6 · WEB
jenkinsci/urltrigger-plugin commit aec43e3 · WEB
jenkinsci/urltrigger-plugin · PACKAGE
jenkins.io/security/advisory/2018-06-25 · WEB

More vulnerabilities in org.jenkins-ci.plugins:urltrigger

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:urltrigger

Maven

< 0.43

0.43

urltrigger

jenkins

≤ 0.41

No fix yet

Description

NVD description