Jenkins Ldap Plugin
Monthly
Server-side request forgery in Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows low-privileged authenticated attackers to cause the Jenkins server to initiate connections to arbitrary, attacker-specified URLs via unsanitized Stapler data binding on the LDAP configuration endpoint. This enables internal network probing or interaction with attacker-controlled infrastructure from the Jenkins server's network perspective. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Server-side request forgery in Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows low-privileged authenticated attackers to cause the Jenkins server to initiate connections to arbitrary, attacker-specified URLs via unsanitized Stapler data binding on the LDAP configuration endpoint. This enables internal network probing or interaction with attacker-controlled infrastructure from the Jenkins server's network perspective. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.