CVE-2017-1000087
Medium
Description
GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Jenkins Github Branch Source
PublishedOct 5, 2017
First seenOct 5, 2017
How to fix
Update
- org.jenkins-ci.plugins:github-branch-source2.2.0-alpha-1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jenkins github_branch_source | v ≤ 2.0.7, 0.1, 1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.8.1, 1.9, 1.10, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.2.0 | — |
| org.jenkins-ci.plugins:github-branch-sourceMaven | v < 2.2.0-alpha-1 | 2.2.0-alpha-1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.