Lucene search

[email protected]CVE-2017-1000091

HistoryOct 05, 2017 - 1:29 a.m.

CVE-2017-1000091

2017-10-0501:29:03

CWE-352

[email protected]

web.nvd.nist.gov

github

branch source

plugin

cve-2017-1000091

security

jenkins

permissions

csrf

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

0.001 Low

EPSS

Percentile

19.4%

JSON

GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan Credentials are correct). This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect to any web server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery.

Affected configurations

NVD

Node

jenkinsgithub_branch_sourceMatch0.1beta-1jenkins

jenkinsgithub_branch_sourceMatch0.1beta-2jenkins

jenkinsgithub_branch_sourceMatch0.1beta-3jenkins

jenkinsgithub_branch_sourceMatch0.1beta-4jenkins

jenkinsgithub_branch_sourceMatch1.0jenkins

jenkinsgithub_branch_sourceMatch1.1jenkins

jenkinsgithub_branch_sourceMatch1.2jenkins

jenkinsgithub_branch_sourceMatch1.3jenkins

jenkinsgithub_branch_sourceMatch1.4jenkins

jenkinsgithub_branch_sourceMatch1.4beta-1jenkins

jenkinsgithub_branch_sourceMatch1.5jenkins

jenkinsgithub_branch_sourceMatch1.6jenkins

jenkinsgithub_branch_sourceMatch1.7jenkins

jenkinsgithub_branch_sourceMatch1.8jenkins

jenkinsgithub_branch_sourceMatch1.8.1jenkins

jenkinsgithub_branch_sourceMatch1.9jenkins

jenkinsgithub_branch_sourceMatch1.10jenkins

jenkinsgithub_branch_sourceMatch2.0.0jenkins

jenkinsgithub_branch_sourceMatch2.0.0beta-1jenkins

jenkinsgithub_branch_sourceMatch2.0.0beta-2jenkins

jenkinsgithub_branch_sourceMatch2.0.1jenkins

jenkinsgithub_branch_sourceMatch2.0.1beta-1jenkins

jenkinsgithub_branch_sourceMatch2.0.1beta-2jenkins

jenkinsgithub_branch_sourceMatch2.0.1beta-3jenkins

jenkinsgithub_branch_sourceMatch2.0.1beta-4jenkins

jenkinsgithub_branch_sourceMatch2.0.1beta-5jenkins

jenkinsgithub_branch_sourceMatch2.0.1beta-6jenkins

jenkinsgithub_branch_sourceMatch2.0.2jenkins

jenkinsgithub_branch_sourceMatch2.0.3jenkins

jenkinsgithub_branch_sourceMatch2.0.4jenkins

jenkinsgithub_branch_sourceMatch2.0.4beta-1jenkins

jenkinsgithub_branch_sourceMatch2.0.5jenkins

jenkinsgithub_branch_sourceMatch2.0.6jenkins

jenkinsgithub_branch_sourceMatch2.0.7jenkins

jenkinsgithub_branch_sourceMatch2.2.0alpha-1jenkins

jenkinsgithub_branch_sourceMatch2.2.0alpha-2jenkins

jenkinsgithub_branch_sourceMatch2.2.0alpha-3jenkins

jenkinsgithub_branch_sourceMatch2.2.0alpha-4jenkins

jenkinsgithub_branch_sourceMatch2.2.0beta-1jenkins

CPENameOperatorVersion
jenkins:github_branch_sourcejenkins github branch sourceeq0.1
jenkins:github_branch_sourcejenkins github branch sourceeq1.0
jenkins:github_branch_sourcejenkins github branch sourceeq1.1
jenkins:github_branch_sourcejenkins github branch sourceeq1.2
jenkins:github_branch_sourcejenkins github branch sourceeq1.3
jenkins:github_branch_sourcejenkins github branch sourceeq1.4
jenkins:github_branch_sourcejenkins github branch sourceeq1.5
jenkins:github_branch_sourcejenkins github branch sourceeq1.6
jenkins:github_branch_sourcejenkins github branch sourceeq1.7
jenkins:github_branch_sourcejenkins github branch sourceeq1.8

CPE	Name	Operator	Version
jenkins:github_branch_source	jenkins github branch source	eq	0.1
jenkins:github_branch_source	jenkins github branch source	eq	1.0
jenkins:github_branch_source	jenkins github branch source	eq	1.1
jenkins:github_branch_source	jenkins github branch source	eq	1.2
jenkins:github_branch_source	jenkins github branch source	eq	1.3
jenkins:github_branch_source	jenkins github branch source	eq	1.4
jenkins:github_branch_source	jenkins github branch source	eq	1.5
jenkins:github_branch_source	jenkins github branch source	eq	1.6
jenkins:github_branch_source	jenkins github branch source	eq	1.7
jenkins:github_branch_source	jenkins github branch source	eq	1.8

Rows per page:

1-10 of 221

References

jenkins.io/security/advisory/2017-07-10/

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

0.001 Low

EPSS

Percentile

19.4%

JSON

Related for CVE-2017-1000091

prion1 osv2 github1 cvelist1 nvd1