CVE-2017-1000093
High
Description
Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name. While Jenkins in general does not consider polling to be a protection-worthy action as it's similar to cache invalidation, the plugin specifically adds a permission to be able to use this functionality, and this issue undermines that permission.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Jenkins Poll Scm
PublishedOct 5, 2017
First seenOct 5, 2017
How to fix
Update
- org.jenkins-ci.plugins:pollscm1.3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jenkins poll_scm | v ≤ 1.3.1 | — |
| org.jenkins-ci.plugins:pollscmMaven | v < 1.3.1 | 1.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.