CVE-2018-1000600 - jenkins-plugin-github: CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials (SECURITY-915)

Back Back to CVE browser

HIGH

jenkins-plugin-github: CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials (SECURITY-915)

Published Jun 26, 2018

8.8

HIGH

CVSS 3.0

EPSS 90.89%

Description

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products

Product	Package	State	Advisory
Red Hat OpenShift Enterprise 3	jenkins-plugin-github	Affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-352

CSRF

References (8)

https://access.redhat.com/security/cve/CVE-2018-1000600
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1596120
Issue Tracking
https://github.com/advisories/GHSA-6cvm-v6qj-hjq9
Advisory
https://github.com/jenkinsci/github-plugin/commit/ce7f5f2cb523757f2bf9ec362e1c8de1de447ec7
https://jenkins.io/security/advisory/2018-06-25/
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-915
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000600
https://www.cve.org/CVERecord?id=CVE-2018-1000600

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2018-1000600		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1596120		Issue Tracking
https://github.com/advisories/GHSA-6cvm-v6qj-hjq9		Advisory
https://github.com/jenkinsci/github-plugin/commit/ce7f5f2cb523757f2bf9ec362e1c8de1de447ec7
https://jenkins.io/security/advisory/2018-06-25/
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-915		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000600
https://www.cve.org/CVERecord?id=CVE-2018-1000600