CVE:CVE-2019-16553
CNNVD:CNNVD-201912-805
CloudBees Jenkins Build Failure Analyzer Plugin 1.24.1及之前版本中存在跨站请求伪造漏洞。攻击者可通过发送计算量较大的正则表达式利用该漏洞导致请求处理线程挂起。
solution:Upgrade jenkins build_failure_analyzer to a higher version than 1.24.1,and avoid the version (,1.24.1]