VulnCheck KEV: CVE-2018-1000600

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

com.barchart.jenkins:maven-release-cascade (>=1.0.0, <=1.0.2), com.base2services.jenkins:github-sqs-plugin (>=1.0, <=1.5) +25 more potentially affected by CVE-2018-1000600 via com.coravy.hudson.plugins.github:github (>=1.2, <=1.27.0)

com.coravy.hudson.plugins.github:github MAVEN version =1.2, =1.0.0, =1.0, =4.0.9, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =1.0.0-b15, =1.0.0-b15, =1.0-alpha-8, =1.0-alpha-4, =0.1-preview-4, =1.0-alpha-1, =1.3.0-alpha.1, =1.0, =0.9.14, =4.0.8 and more Source cves: CVE-2018-1000600 Source advisor...

com.barchart.jenkins:maven-release-cascade (>=1.0.0, <=1.0.2), com.base2services.jenkins:github-sqs-plugin (>=1.0, <=1.5) +25 more potentially affected by CVE-2018-1000600 via com.coravy.hudson.plugins.github:github (>=1.2, <=1.27.0)

com.coravy.hudson.plugins.github:github MAVEN version =1.2, =1.0.0, =1.0, =4.0.9, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =1.0.0-b15, =1.0.0-b15, =1.0-alpha-8, =1.0-alpha-4, =0.1-preview-4, =1.0-alpha-1, =1.3.0-alpha.1, =1.0, =0.9.14, =4.0.8 and more Source cves: CVE-2018-1000600 Source advisor...

CVE-2018-1000600

creationtimestamp| type| source ---|---|--- 2021-09-21 06:42:55+00:00| published-proof-of-concept| https://t.me/pwnwikizhchannel/9...

CVE-2018-1000600

The Jenkins GitHub Plugin (version 1.29.1 and earlier) is vulnerable to a Server-Side Request Forgery (SSRF) and exposure of sensitive information in the GitHubTokenCredentialsCreator.java file. The root cause is a failure to properly detect access rights, allowing an attacker to use attacker-spe...