CVE-2017-1000091

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan Credentials are correct). This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect to any web server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery.

Metrics

CVSS 3.0 6.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Oct 5, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-10000927.5Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to CVE-2017-10000938.8Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This aCVE-2017-10000946.5Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to CVE-2017-10000956.5The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(CVE-2017-10000968.8Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in PiCVE-2017-10000977.5On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain thatCVE-2017-10000987.5The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "mCVE-2017-10000996.5When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The CVE-2017-100017.6Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications (subcomponent: Core). The supporCVE-2017-10001006.5When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name CVE-2017-10001016.5curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence ofCVE-2017-10001025.4The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Maliciou