CVE-2017-1000087

The Connected documents confirm a vulnerability in the Jenkins GitHub Branch Source Plugin: any user with Overall/Read permission could enumerate credential IDs by accessing the job context, due to missing permission checks. The issue enables potential credential disclosure and could facilitate c...

CVE-2017-1000091

The CVE-2017-1000091 entry concerns the Jenkins GitHub Branch Source Plugin, where form validation against a user-specified GitHub API URL allowed unauthorized credential access. The root cause is improper permission checks that let any user with Overall/Read access connect to a web server and se...

CVE-2017-1000087

GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part...

PT-2017-10796

Name of the Vulnerable Software and Affected Versions GitHub Branch Source Plugin affected versions not specified Description The GitHub Branch Source Plugin has a functionality that connects to a user-specified GitHub API URL as part of form validation and completion. This functionality improper...

PT-2017-10792

Name of the Vulnerable Software and Affected Versions GitHub Branch Source affected versions not specified Description The issue concerns a lack of permission checks in GitHub Branch Source, allowing users with Overall/Read permission to obtain a list of valid credential IDs. This could be...