CVE-2017-1000087

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Oct 5, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-10000885.4The Sidebar Link plugin allows users able to configure jobs, views, and agents to add entries to the sidebar of these objects. There was no CVE-2017-10000895.3Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in CVE-2017-10000908.8Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site RequesCVE-2017-10000916.3GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (CVE-2017-10000927.5Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to CVE-2017-10000938.8Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This aCVE-2017-10000946.5Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to CVE-2017-10000956.5The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(CVE-2017-10000968.8Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in PiCVE-2017-10000977.5On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain thatCVE-2017-10000987.5The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "mCVE-2017-10000996.5When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The