CVE-2017-1000094
Medium
Description
Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to authenticate with a Docker Registry. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Jenkins Docker Commons
PublishedOct 5, 2017
First seenOct 5, 2017
How to fix
Update
- org.jenkins-ci.plugins:docker-commons1.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jenkins docker_commons | v ≤ 1.9 | — |
| org.jenkins-ci.plugins:docker-commonsMaven | v < 1.8 | 1.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.