CVE-2017-1000087: Exposure of Sensitive Information to an Unauthorized Actor

GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part...

CVE-2017-1000091

GitHub Branch Source Plugin connects to a user-specified GitHub API URL e.g. GitHub Enterprise as part of form validation and completion e.g. to verify Scan Credentials are correct. This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect...

CVE-2017-1000091

GitHub Branch Source Plugin connects to a user-specified GitHub API URL e.g. GitHub Enterprise as part of form validation and completion e.g. to verify Scan Credentials are correct. This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect...

CVE-2017-1000087

GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part...

PT-2017-10796

Name of the Vulnerable Software and Affected Versions GitHub Branch Source Plugin affected versions not specified Description The GitHub Branch Source Plugin has a functionality that connects to a user-specified GitHub API URL as part of form validation and completion. This functionality improper...

PT-2017-10792

Name of the Vulnerable Software and Affected Versions GitHub Branch Source affected versions not specified Description The issue concerns a lack of permission checks in GitHub Branch Source, allowing users with Overall/Read permission to obtain a list of valid credential IDs. This could be...