vendor:
Jenkins
by:
Kl3_GMjq6
8.0
CVSS
HIGH
Cross-Site Request Forgery
352
CWE
Product Name: Jenkins
Affected Version From: 1.1
Affected Version To: 1.20
Patch Exists: YES
Related CWE: CVE-2018-8718
CPE: a:jenkins:jenkins
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Linux, Windows
2018
Jenkins mailer plugin < 1.20 - Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability exists in Jenkins mailer plugin versions below 1.20, which allows attackers to send malicious emails to arbitrary recipients. This vulnerability is due to insufficient CSRF protection in the mailer plugin. An attacker can exploit this vulnerability by tricking a user into clicking a malicious link or sending a malicious request to the Jenkins server.
Mitigation:
Upgrade Jenkins mailer plugin to version 1.20 or later.