| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:urltrigger | < 0.43 | 0.43 |
| urltrigger | ≤ 0.41 |
A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. As of version 0.43, this form validation method no longer connects to a user provided URL.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free