Published: 27/03/2018 Updated: 04/03/2019

CVSS v2 Base Score: 6 | Impact Score: 6.4 | Exploitability Score: 6.8

CVSS v3 Base Score: 8 | Impact Score: 5.9 | Exploitability Score: 2.1

VMScore: 605

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P

Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
jenkins mailer

Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 120 for Jenkins 2111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudsontasksMailer/sendTestMail request ...

# Exploit Title : Jenkins mailer plugin < 120 - Cross-Site Request Forgery # Date : 2018-06-05 # Exploit Author : Kl3_GMjq6 # Vendor Homepage : jenkinsio/ # Software Link : [updatesjenkinsio/download/plugins/mailer/120/mailerhpi] # Version: [Below Version 120 (11 ~ 120) ] # Ref: jenkinsio/security/advisory/2018- ...

Jenkins Mailer plugin versions prior to 120 suffer from a cross site request forgery vulnerability ...

POC of CVE-2018-8718 + tool

################################################### #Exploit Title : [Jenkins] mailer plugin CSRF Vulnerability - Send CSRF MAIL #Date : [2018/06/05] #Exploit Author : [Yeom Geun Cheol] #Vendor Homepage : [jenkinsio/] #Software Link : [updatesjenkinsio/download/plugins/mailer/120/mailerhpi] #Version: [Below Version 120 (11 ~ 120) ] #Tested on : [Linux ,

CWE-352 https://jenkins.io/security/advisory/2018-03-26/http://www.openwall.com/lists/oss-security/2018/03/26/3 http://www.securityfocus.com/bid/103691 https://www.exploit-db.com/exploits/44843/https://nvd.nist.gov https://github.com/GeunSam2/CVE-2018-8718 https://www.exploit-db.com/exploits/44843/https://access.redhat.com/security/cve/cve-2018-8718

CVE-2018-8718

Vulnerability Summary

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect