CVE-2017-1000093

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name. While Jenkins in general does not consider polling to be a protection-worthy action as it's similar to cache invalidation, the plugin specifically adds a permission to be able to use this functionality, and this issue undermines that permission.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10000946.5Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to CVE-2017-10000956.5The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(CVE-2017-10000968.8Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pi CVE-2017-10000977.5On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that CVE-2017-10000987.5The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "m CVE-2017-10000996.5When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The CVE-2017-100017.6Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications (subcomponent: Core). The suppor CVE-2017-10001006.5When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name CVE-2017-10001016.5curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of CVE-2017-10001025.4The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Maliciou CVE-2017-10001035.4The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability:CVE-2017-10001046.5The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with on