CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials

2022-05-1301:48:38

Google

osv.dev

csrf

vulnerability

jenkins

github plugin

exposure

sensitive information

missing permission checks

credentials capture

AI Score

6.1

Confidence

High

EPSS

0.956

Percentile

99.5%

JSON

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.