CVE-2017-1000091

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2017-1000091

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000091.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-1000091

Aliases

GHSA-w66r-f5gg-gqwm

Published

2017-10-05T01:29:03.743Z

Modified

2026-07-08T12:54:01.583327Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

[none]

Details

GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan Credentials are correct). This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect to any web server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery.

References

https://jenkins.io/security/advisory/2017-07-10/

Affected packages

Git / github.com/jenkinsci/github-branch-source-plugin

Affected ranges

Type

GIT

Repo

https://github.com/jenkinsci/github-branch-source-plugin

Events

Introduced

5e2f4e75243820e6925b74efb783eba652809b66

Last affected

f2d5f8864a1cf62e67195aedd9222f5a806f7237

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.1-beta\\-1"
        },
        {
            "last_affected": "0.1-beta\\-1"
        },
        {
            "introduced": "0.1-beta\\-2"
        },
        {
            "last_affected": "0.1-beta\\-2"
        },
        {
            "introduced": "0.1-beta\\-3"
        },
        {
            "last_affected": "0.1-beta\\-3"
        },
        {
            "introduced": "0.1-beta\\-4"
        },
        {
            "last_affected": "0.1-beta\\-4"
        },
        {
            "introduced": "1.0"
        },
        {
            "last_affected": "1.0"
        },
        {
            "introduced": "1.1"
        },
        {
            "last_affected": "1.1"
        },
        {
            "introduced": "1.2"
        },
        {
            "last_affected": "1.2"
        },
        {
            "introduced": "1.3"
        },
        {
            "last_affected": "1.3"
        },
        {
            "introduced": "1.4"
        },
        {
            "last_affected": "1.4"
        },
        {
            "introduced": "1.4-beta\\-1"
        },
        {
            "last_affected": "1.4-beta\\-1"
        },
        {
            "introduced": "1.5"
        },
        {
            "last_affected": "1.5"
        },
        {
            "introduced": "1.6"
        },
        {
            "last_affected": "1.6"
        },
        {
            "introduced": "1.7"
        },
        {
            "last_affected": "1.7"
        },
        {
            "introduced": "1.8"
        },
        {
            "last_affected": "1.8"
        },
        {
            "introduced": "1.8.1"
        },
        {
            "last_affected": "1.8.1"
        },
        {
            "introduced": "1.9"
        },
        {
            "last_affected": "1.9"
        },
        {
            "introduced": "1.10"
        },
        {
            "last_affected": "1.10"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.0.0"
        },
        {
            "introduced": "2.0.0-beta\\-1"
        },
        {
            "last_affected": "2.0.0-beta\\-1"
        },
        {
            "introduced": "2.0.0-beta\\-2"
        },
        {
            "last_affected": "2.0.0-beta\\-2"
        },
        {
            "introduced": "2.0.1"
        },
        {
            "last_affected": "2.0.1"
        },
        {
            "introduced": "2.0.1-beta\\-1"
        },
        {
            "last_affected": "2.0.1-beta\\-1"
        },
        {
            "introduced": "2.0.1-beta\\-2"
        },
        {
            "last_affected": "2.0.1-beta\\-2"
        },
        {
            "introduced": "2.0.1-beta\\-3"
        },
        {
            "last_affected": "2.0.1-beta\\-3"
        },
        {
            "introduced": "2.0.1-beta\\-4"
        },
        {
            "last_affected": "2.0.1-beta\\-4"
        },
        {
            "introduced": "2.0.1-beta\\-5"
        },
        {
            "last_affected": "2.0.1-beta\\-5"
        },
        {
            "introduced": "2.0.1-beta\\-6"
        },
        {
            "last_affected": "2.0.1-beta\\-6"
        },
        {
            "introduced": "2.0.2"
        },
        {
            "last_affected": "2.0.2"
        },
        {
            "introduced": "2.0.3"
        },
        {
            "last_affected": "2.0.3"
        },
        {
            "introduced": "2.0.4"
        },
        {
            "last_affected": "2.0.4"
        },
        {
            "introduced": "2.0.4-beta\\-1"
        },
        {
            "last_affected": "2.0.4-beta\\-1"
        },
        {
            "introduced": "2.0.5"
        },
        {
            "last_affected": "2.0.5"
        },
        {
            "introduced": "2.0.6"
        },
        {
            "last_affected": "2.0.6"
        },
        {
            "introduced": "2.0.7"
        },
        {
            "last_affected": "2.0.7"
        },
        {
            "introduced": "2.2.0-alpha\\-1"
        },
        {
            "last_affected": "2.2.0-alpha\\-1"
        },
        {
            "introduced": "2.2.0-alpha\\-2"
        },
        {
            "last_affected": "2.2.0-alpha\\-2"
        },
        {
            "introduced": "2.2.0-alpha\\-3"
        },
        {
            "last_affected": "2.2.0-alpha\\-3"
        },
        {
            "introduced": "2.2.0-alpha\\-4"
        },
        {
            "last_affected": "2.2.0-alpha\\-4"
        },
        {
            "introduced": "2.2.0-beta\\-1"
        },
        {
            "last_affected": "2.2.0-beta\\-1"
        }
    ],
    "cpe": [
        "cpe:2.3:a:jenkins:github_branch_source:0.1:beta-1:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:0.1:beta-2:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:0.1:beta-3:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:0.1:beta-4:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:1.0:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:1.1:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:1.2:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:1.3:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:1.4:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:1.4:beta-1:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:1.5:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:1.6:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:1.7:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:1.8:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:1.8.1:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:1.9:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:1.10:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.0:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.0:beta-1:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.0:beta-2:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.1:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.1:beta-1:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.1:beta-2:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.1:beta-3:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.1:beta-4:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.1:beta-5:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.1:beta-6:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.2:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.3:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.4:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.4:beta-1:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.5:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.6:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.0.7:*:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.2.0:alpha-1:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.2.0:alpha-2:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.2.0:alpha-3:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.2.0:alpha-4:*:*:*:jenkins:*:*",
        "cpe:2.3:a:jenkins:github_branch_source:2.2.0:beta-1:*:*:*:jenkins:*:*"
    ],
    "source": "CPE_STRING"
}

Affected versions

0.*

0.1-beta\-1

0.1-beta\-2

0.1-beta\-3

0.1-beta\-4

1.*

1.0

1.1

1.10

1.2

1.3

1.4

1.4-beta\-1

1.5

1.6

1.7

1.8

1.8.1

1.9

2.*

2.0.0

2.0.0-beta\-1

2.0.0-beta\-2

2.0.1

2.0.1-beta\-1

2.0.1-beta\-2

2.0.1-beta\-3

2.0.1-beta\-4

2.0.1-beta\-5

2.0.1-beta\-6

2.0.2

2.0.3

2.0.4

2.0.4-beta\-1

2.0.5

2.0.6

2.0.7

2.2.0-alpha\-1

2.2.0-alpha\-2

2.2.0-alpha\-3

2.2.0-alpha\-4

2.2.0-beta\-1

github-branch-source-0.*

github-branch-source-0.1-beta-1

github-branch-source-0.1-beta-2

github-branch-source-0.1-beta-3

github-branch-source-0.1-beta-4

github-branch-source-1.*

github-branch-source-1.0

github-branch-source-1.1

github-branch-source-1.10

github-branch-source-1.2

github-branch-source-1.3

github-branch-source-1.4

github-branch-source-1.4-beta-1

github-branch-source-1.5

github-branch-source-1.6

github-branch-source-1.7

github-branch-source-1.8

github-branch-source-1.8.1

github-branch-source-1.9

github-branch-source-2.*

github-branch-source-2.0.0

github-branch-source-2.0.0-beta-1

github-branch-source-2.0.0-beta-2

github-branch-source-2.0.1

github-branch-source-2.0.1-beta-1

github-branch-source-2.0.1-beta-2

github-branch-source-2.0.1-beta-3

github-branch-source-2.0.1-beta-4

github-branch-source-2.0.1-beta-5

github-branch-source-2.0.1-beta-6

github-branch-source-2.0.2

github-branch-source-2.0.3

github-branch-source-2.0.4

github-branch-source-2.0.4-beta-1

github-branch-source-2.0.5

github-branch-source-2.0.6

github-branch-source-2.0.7

github-branch-source-2.2.0-beta-1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000091.json"