Cross-Site Request Forgery in Jenkins Mailer Plugin

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2018-8718 · ADVISORY
• jenkinsci/mailer-plugin commit 98e79cf · WEB
• jenkins.io/security/advisory/2018-03-26 · WEB
• exploit-db.com/exploits/44843 · WEB
• openwall.com/lists/oss-security/2018/03/26/3 · WEB
• securityfocus.com/bid/103691 · WEB
• jenkins.io/security/advisory/2018-03-26 · Vendor Advisory
• exploit-db.com/exploits/44843 · Exploit

org.jenkins-ci.plugins:mailer のその他の脆弱性

• CVE-2022-20614中 4.3A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DN…
• CVE-2022-20613中 4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS …
• CVE-2020-2252中 4.8Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server.
• CVE-2017-2651低 3.7jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically…