BLOG

標籤含有 #SSRF 的所有文章

技術專欄 #Advisory #CVE #infoleak #SSRF

Hacking Jenkins Part 1 - Play with Dynamic Routing

orange

 2019-01-16

這篇文章主要是分享去年中針對 Jenkins 所做的一次簡單 Security Review, 過程中共發現了五個 CVE 如下： CVE-2018-1999002(Arbitrary file read vulnerability), CVE-2018-1000600(CSRF and missing permission checks in GitHub Plugin), CVE-2018-1999046(Unauthorized users could access agent logs), CVE-2018-1000861(Code execution through crafted URLs), CVE-2019-pending(Sandbox Bypass in Script Security and Pipeline Plugins)