CVE-2018-1000600

CVE-2018-1000600 affects the Jenkins GitHub Plugin (versions ≤ 1.29.1). The accompanying Nuclei template describes a server-side request forgery (SSRF) vulnerability in GitHubTokenCredentialsCreator.java, enabling an attacker to use an attacker-specified URL and credentials IDs obtained via anoth...

CVE-2018-1000183

The CVE-2018-1000183 entry describes an information disclosure in the Jenkins GitHub Plugin (versions 1.29.0 and earlier) via GitHubServerConfig.java. Attackers with Overall/Read access could connect to an attacker-specified URL using attacker-specified credentials IDs, causing credentials stored...

CVE-2018-1000184

The CVE refers to a server-side request forgery in the Jenkins GitHub Plugin (versions ≤ 1.29.0) where the vulnerable code GitHubPluginConfig.java allows an attacker with Overall/Read access to trigger Jenkins to issue a GET request to an arbitrary URL. This SSRF impact is documented across multi...