CVE-2017-1000091 – org.jenkins-ci.plugins:github-branch-source

Package

Manager: maven
Name: org.jenkins-ci.plugins:github-branch-source
Vulnerable Version: >=0 <2.2.0-alpha-1

Severity

Level: Medium

CVSS v3.1: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

EPSS: 0.00066 pctl0.20885

Details

Jenkins GitHub Branch Source Plugin vulnerable to Cross-Site Request Forgery GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan Credentials are correct). This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect to any web server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery. An enumeration of credentials IDs in this plugin now requires the permission to have Extended Read permission (when that permission is enabled; otherwise Configure permission) to the job in whose context credentials are being accessed. If no job context exists, Overall/Administer permission is required.

Metadata

Created: 2022-05-17T00:33:21Z
Modified: 2022-12-12T21:31:46Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w66r-f5gg-gqwm/GHSA-w66r-f5gg-gqwm.json
CWE IDs: ["CWE-352"]
Alternative ID: GHSA-w66r-f5gg-gqwm
Finding: F007
Auto approve: 1