CVE-2017-1000092

2017-10-0501:29:03

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.0%

JSON

Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.

CPENameOperatorVersion
git-plugineqgit-1.1.12
git-plugineqgit-1.1.8
git-plugineqgit-1.1.2
git-plugineqgit-2.5.3
git-plugineqgit-1.3.0
git-plugineqgit-2.0.3
git-plugineqgit-2.5.0-beta4
git-plugineqgit-2.0-beta-3
git-plugineqgit-2.0.1
git-plugineqgit-2.0.2

Name	Operator	Version
git-plugin	eq	git-1.1.12
git-plugin	eq	git-1.1.8
git-plugin	eq	git-1.1.2
git-plugin	eq	git-2.5.3
git-plugin	eq	git-1.3.0
git-plugin	eq	git-2.0.3
git-plugin	eq	git-2.5.0-beta4
git-plugin	eq	git-2.0-beta-3
git-plugin	eq	git-2.0.1
git-plugin	eq	git-2.0.2