Start Windocks Container
Monthly
Missing permission checks in Jenkins Start Windocks Containers Plugin 1.4 and earlier let any authenticated user holding the baseline Overall/Read permission force the Jenkins controller to make an outbound HTTP connection to a URL of the attacker's choosing, a classic server-side request forgery (SSRF) pattern with integrity-only impact. Only Jenkins instances with the plugin installed are affected; the Jenkins core itself is not vulnerable, and exploitation requires a valid account with at least read-level access, so anonymous or unauthenticated attacks are not indicated by the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3). Severity signals are mutually consistent and point to a genuine-but-low-priority issue: EPSS is just 0.25% (15th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV listing indicating active exploitation.
Cross-site request forgery in the Jenkins Start Windocks Containers Plugin 1.4 and earlier lets an attacker cause the Jenkins controller to open an outbound connection to a URL of the attacker's choosing by luring a victim into submitting a forged request. The assessed impact is limited to the integrity of that connection endpoint (CVSS 4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) - an SSRF-style issue rather than code execution or data disclosure - and it only succeeds when Jenkins' default CSRF crumb protection is disabled or bypassable and a victim with an active authenticated session is socially engineered. EPSS is very low (0.21%, 10th percentile), there is confirmed actively exploited status absent from CISA KEV, and no public exploit identified at time of analysis; this makes it a moderate-to-low priority, and the multiple signals agree rather than conflict.
Missing permission checks in Jenkins Start Windocks Containers Plugin 1.4 and earlier let any authenticated user holding the baseline Overall/Read permission force the Jenkins controller to make an outbound HTTP connection to a URL of the attacker's choosing, a classic server-side request forgery (SSRF) pattern with integrity-only impact. Only Jenkins instances with the plugin installed are affected; the Jenkins core itself is not vulnerable, and exploitation requires a valid account with at least read-level access, so anonymous or unauthenticated attacks are not indicated by the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3). Severity signals are mutually consistent and point to a genuine-but-low-priority issue: EPSS is just 0.25% (15th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV listing indicating active exploitation.
Cross-site request forgery in the Jenkins Start Windocks Containers Plugin 1.4 and earlier lets an attacker cause the Jenkins controller to open an outbound connection to a URL of the attacker's choosing by luring a victim into submitting a forged request. The assessed impact is limited to the integrity of that connection endpoint (CVSS 4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) - an SSRF-style issue rather than code execution or data disclosure - and it only succeeds when Jenkins' default CSRF crumb protection is disabled or bypassable and a victim with an active authenticated session is socially engineered. EPSS is very low (0.21%, 10th percentile), there is confirmed actively exploited status absent from CISA KEV, and no public exploit identified at time of analysis; this makes it a moderate-to-low priority, and the multiple signals agree rather than conflict.