CVE-2018-1000606: URLTrigger Plugin server-side request forgery vulnerability in org.jenkins-ci.plugins:urltrigger
Summary
CVE-2018-1000606: URLTrigger Plugin server-side request forgery vulnerability. Affects org.jenkins-ci.plugins:urltrigger versions < 0.43. Fixed in 0.43. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.jenkins-ci.plugins:urltrigger package is a Maven ecosystem plugin for Jenkins, a popular open-source automation server. This plugin allows users to trigger Jenkins jobs based on changes to a specified URL. It provides functionality for monitoring external resources and initiating build processes in response to changes. However, versions 0.41 and earlier of the plugin contain a server-side request forgery vulnerability in the URLTrigger.java file. This vulnerability allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. The vulnerability has a CVSS score of 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
Vulnerability Detail
The server-side request forgery vulnerability in the URLTrigger Plugin allows attackers with Overall/Read access to manipulate Jenkins into making unintended GET requests to arbitrary URLs. This can lead to various security risks, including unauthorized access to internal resources, information disclosure, and potential remote code execution. The vulnerability arises from a lack of proper input validation and sanitization in the URLTrigger.java file. Versions 0.41 and earlier are affected, while version 0.43 and later have addressed this issue by removing the form validation method that connects to user-provided URLs.
How To Fix
Latest published version: 1.06 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.43
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable or remove the URLTrigger Plugin from their Jenkins installation if it is not essential for their workflows. This can be done by navigating to the Jenkins plugin management page and disabling or uninstalling the URLTrigger Plugin. However, this workaround may impact any jobs or processes relying on the functionality provided by the plugin.
Conclusion
The URLTrigger Plugin in the org.jenkins-ci.plugins:urltrigger package has a server-side request forgery vulnerability that allows attackers to manipulate Jenkins into making unintended GET requests. This can lead to unauthorized access, information disclosure, and potential remote code execution. Users are advised to upgrade to version 0.43 or later of the plugin and regularly update Jenkins and its plugins to ensure the latest security patches are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:urltrigger →
FAQ
The vulnerability allows attackers to manipulate Jenkins into making unintended GET requests to arbitrary URLs. This can lead to unauthorized access, information disclosure, and potential remote code execution.
Users of Jenkins with Overall/Read access and the URLTrigger Plugin version 0.41 or earlier are affected by this vulnerability.
Yes, the vulnerability has been addressed in version 0.43 of the URLTrigger Plugin by removing the form validation method that connects to user-provided URLs.
A temporary workaround is to disable or remove the URLTrigger Plugin from the Jenkins installation if it is not necessary for the workflows. However, this may impact any jobs or processes relying on the plugin's functionality.
To protect your Jenkins installation, it is recommended to upgrade the URLTrigger Plugin to version 0.43 or later and regularly update Jenkins and its plugins to apply the latest security patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:urltrigger.
