Repository Configuration Vulnerability in Jenkins Blue Ocean Plugin

CVE-2017-1000110

What is CVE-2017-1000110?

The Blue Ocean plugin for Jenkins contains a vulnerability that arises from improper authentication and authorization checks when configuring GitHub organization folders. This flaw permits users with merely read access to the folder to alter configurations, potentially redirecting GitHub API requests to malicious servers. This could allow an attacker to capture sensitive information such as GitHub access tokens, posing significant security risks to the CI/CD pipelines associated with the affected GitHub organizations.

References