Описание
An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have Jenkins perform a connection test, connecting to an attacker-specified server with attacker-specified credentials and connection settings.
Ссылки
- Third Party AdvisoryVDB Entry
- Vendor Advisory
- Third Party AdvisoryVDB Entry
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.0.0 (включая)
cpe:2.3:a:atlassian:crowd2:*:*:*:*:*:jenkins:*:*
EPSS
Процентиль: 34%
0.00139
Низкий
6.5 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-918
Связанные уязвимости
CVSS3: 6.5
github
больше 3 лет назад
Jenkins Crowd 2 Integration Plugin server-side request forgery vulnerability
EPSS
Процентиль: 34%
0.00139
Низкий
6.5 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-918