CVE-2017-1000092

7.5HIGH

Key Information:

Vendor
Jenkins
Status
Git
Vendor
CVE Published:
5 October 2017

Summary

Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.

References

http://www.securityfocus.com/bid/100435
vdb-entryx_refsource_BID
https://jenkins.io/security/advisory/2017-07-10/
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.