Lucene search

[email protected]CVE-2017-1000087

HistoryOct 05, 2017 - 1:29 a.m.

CVE-2017-1000087

2017-10-0501:29:03

CWE-200

[email protected]

web.nvd.nist.gov

github

branch source

permission check

credential exposure

cve-2017-1000087

nvd

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.0%

JSON

GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they’d like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.

Affected configurations

NVD

Node

jenkinsgithub_branch_sourceRange≤2.0.7jenkins

jenkinsgithub_branch_sourceMatch0.1beta-1jenkins

jenkinsgithub_branch_sourceMatch0.1beta-2jenkins

jenkinsgithub_branch_sourceMatch0.1beta-3jenkins

jenkinsgithub_branch_sourceMatch0.1beta-4jenkins

jenkinsgithub_branch_sourceMatch1.0jenkins

jenkinsgithub_branch_sourceMatch1.1jenkins

jenkinsgithub_branch_sourceMatch1.2jenkins

jenkinsgithub_branch_sourceMatch1.3jenkins

jenkinsgithub_branch_sourceMatch1.4jenkins

jenkinsgithub_branch_sourceMatch1.4beta-1jenkins

jenkinsgithub_branch_sourceMatch1.5jenkins

jenkinsgithub_branch_sourceMatch1.6jenkins

jenkinsgithub_branch_sourceMatch1.7jenkins

jenkinsgithub_branch_sourceMatch1.8jenkins

jenkinsgithub_branch_sourceMatch1.8.1jenkins

jenkinsgithub_branch_sourceMatch1.9jenkins

jenkinsgithub_branch_sourceMatch1.10jenkins

jenkinsgithub_branch_sourceMatch2.0.0jenkins

jenkinsgithub_branch_sourceMatch2.0.0beta-1jenkins

jenkinsgithub_branch_sourceMatch2.0.0beta-2jenkins

jenkinsgithub_branch_sourceMatch2.0.1jenkins

jenkinsgithub_branch_sourceMatch2.0.1beta-1jenkins

jenkinsgithub_branch_sourceMatch2.0.1beta-2jenkins

jenkinsgithub_branch_sourceMatch2.0.1beta-3jenkins

jenkinsgithub_branch_sourceMatch2.0.1beta-4jenkins

jenkinsgithub_branch_sourceMatch2.0.1beta-5jenkins

jenkinsgithub_branch_sourceMatch2.0.1beta-6jenkins

jenkinsgithub_branch_sourceMatch2.0.2jenkins

jenkinsgithub_branch_sourceMatch2.0.3jenkins

jenkinsgithub_branch_sourceMatch2.0.4jenkins

jenkinsgithub_branch_sourceMatch2.0.4beta-1jenkins

jenkinsgithub_branch_sourceMatch2.0.5jenkins

jenkinsgithub_branch_sourceMatch2.0.6jenkins

jenkinsgithub_branch_sourceMatch2.2.0jenkins

jenkinsgithub_branch_sourceMatch2.2.0alpha-1jenkins

jenkinsgithub_branch_sourceMatch2.2.0alpha-2jenkins

jenkinsgithub_branch_sourceMatch2.2.0alpha-3jenkins

jenkinsgithub_branch_sourceMatch2.2.0alpha-4jenkins

jenkinsgithub_branch_sourceMatch2.2.0beta-1jenkins

CPENameOperatorVersion
jenkins:github_branch_sourcejenkins github branch sourcele2.0.7
jenkins:github_branch_sourcejenkins github branch sourceeq0.1
jenkins:github_branch_sourcejenkins github branch sourceeq1.0
jenkins:github_branch_sourcejenkins github branch sourceeq1.1
jenkins:github_branch_sourcejenkins github branch sourceeq1.2
jenkins:github_branch_sourcejenkins github branch sourceeq1.3
jenkins:github_branch_sourcejenkins github branch sourceeq1.4
jenkins:github_branch_sourcejenkins github branch sourceeq1.5
jenkins:github_branch_sourcejenkins github branch sourceeq1.6
jenkins:github_branch_sourcejenkins github branch sourceeq1.7

CPE	Name	Operator	Version
jenkins:github_branch_source	jenkins github branch source	le	2.0.7
jenkins:github_branch_source	jenkins github branch source	eq	0.1
jenkins:github_branch_source	jenkins github branch source	eq	1.0
jenkins:github_branch_source	jenkins github branch source	eq	1.1
jenkins:github_branch_source	jenkins github branch source	eq	1.2
jenkins:github_branch_source	jenkins github branch source	eq	1.3
jenkins:github_branch_source	jenkins github branch source	eq	1.4
jenkins:github_branch_source	jenkins github branch source	eq	1.5
jenkins:github_branch_source	jenkins github branch source	eq	1.6
jenkins:github_branch_source	jenkins github branch source	eq	1.7

Rows per page:

1-10 of 221

References

jenkins.io/security/advisory/2017-07-10/

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.0%

JSON

Related for CVE-2017-1000087

prion1 cvelist1 nvd1 osv2 github1