GitHub Organizational Folder Creation Vulnerability in Jenkins by CloudBees
CVE-2017-1000106

8.5HIGH

Key Information:

Vendor

Jenkins
Status
Blue Ocean
Vendor
CVE Published:
5 October 2017

What is CVE-2017-1000106?

Jenkins Blue Ocean enables users to create GitHub organization folders that can scan for repositories and branches. However, a serious authorization flaw in the SCM content REST API fails to validate user credentials. If a folder is created, it retains a reference to the creator's GitHub credentials. This oversight can allow users with merely read access to the GitHub organization folder to execute arbitrary commits in related repositories using the credentials of the creator. Furthermore, these users can access and read arbitrary files contained within those repositories, provided they identify the necessary folder, repository, branch, and file specifics.

References

https://jenkins.io/security/advisory/2017-08-07/
x_refsource_CONFIRM

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.