CVE-2018-1999026: Server-Side Request Forgery (SSRF)

May 14, 2022 (updated January 9, 2024)

A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Jenkins send HTTP requests to an attacker-specified host.

References

github.com/advisories/GHSA-hp7x-282p-hhr9
github.com/jenkinsci/ecutest-plugin/commit/943c4d3c8df521eb94fb99429717e3920c6fc7f7
jenkins.io/security/advisory/2018-07-30/
nvd.nist.gov/vuln/detail/CVE-2018-1999026
web.archive.org/web/20200227115310/http://www.securityfocus.com/bid/104960

Code Behaviors & Features

Detect and mitigate CVE-2018-1999026 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →