Git Plugin Exposure in Jenkins Allows Credential Theft

CVE-2017-1000092

Summary

The Git Plugin in Jenkins is vulnerable due to improper input validation that can be exploited by an attacker. By crafting a malicious Jenkins URL, an adversary can trick a developer with the necessary job configuration permissions into executing a link. This causes the Jenkins Git client to inadvertently send sensitive username and password credentials to a server controlled by the attacker. As a result, without needing direct access to the Jenkins server, attackers can compromise user accounts, leading to potential data breaches and undermining the integrity of the software development lifecycle.

References