com.barchart.jenkins:maven-release-cascade (>=1.0.0, <=1.3.2), com.redhat.jenkins.plugins:build-requester (0.7) +4 more potentially affected by CVE-2018-1000111 via org.jenkins-ci.plugins:subversion (1.45)

org.jenkins-ci.plugins:subversion MAVEN version 1.45 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - com.barchart.jenkins:maven-release-cascade =1.0.0, =0.34, =1.514, =1.12, =1.13 -...

org.jenkins-ci.plugins:artifactory (>=2.0.8, <=2.1.3), org.jenkins-ci.plugins:svn-revert-plugin (>=1.0, <=1.3) +1 more potentially affected by CVE-2018-1000111 via org.jenkins-ci.plugins:subversion (1.37)

org.jenkins-ci.plugins:subversion MAVEN version 1.37 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - org.jenkins-ci.plugins:artifactory =2.0.8, =1.0, =1.0, =1.1 Source cves: CVE-2018-1000111 Sour...

org.jenkins-ci.plugins:scm-sync-configuration (>=0.0.6, <=0.0.9), org.jenkins-ci.plugins:scm2job (>=2.1, <=2.5) potentially affected by CVE-2018-1000111 via org.jenkins-ci.plugins:subversion (1.39)

org.jenkins-ci.plugins:subversion MAVEN version 1.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - org.jenkins-ci.plugins:scm-sync-configuration =0.0.6, =2.1, =2.5 Source cves: CVE-2018-1000111...

com.amcbridge:build-configurator (>=1.0.5.0, <=1.0.6.1), com.barchart.jenkins:maven-release-cascade (>=1.0.0, <=1.3.2) +29 more potentially affected by CVE-2018-1000111 via org.jenkins-ci.plugins:subversion (>=1.25, <=2.9)

org.jenkins-ci.plugins:subversion MAVEN version =1.25, =1.0.5.0, =1.0.0, =1.0.0, =0.33, =1.412, =0.1-beta-1, =0.1-beta-1, =2.0.8, =1.6, =1.0.1, =1.5, =1.1.0, =1.12, =1.13 and more Source cves: CVE-2018-1000111 Source advisory: MEND:CVE-2018-1000111...

CVE-2018-1000111

CVE-2018-1000111 affects the Jenkins Subversion Plugin (versions 2.10.2 and earlier). The root cause is improper authorization in SubversionStatus.java and SubversionRepositoryStatus.java, enabling an attacker with network access to obtain a list of nodes and users. The vulnerability enables info...