7.5

CVE-2017-1000092

Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jenkins ≫ Git Version 0.1.0 SwPlatform jenkins
Jenkins ≫ Git Version 0.2.0 SwPlatform jenkins
Jenkins ≫ Git Version 0.3.0 SwPlatform jenkins
Jenkins ≫ Git Version 0.4.0 SwPlatform jenkins
Jenkins ≫ Git Version 0.5.0 SwPlatform jenkins
Jenkins ≫ Git Version 0.6.0 SwPlatform jenkins
Jenkins ≫ Git Version 0.7.0 SwPlatform jenkins
Jenkins ≫ Git Version 0.7.1 SwPlatform jenkins
Jenkins ≫ Git Version 0.7.2 SwPlatform jenkins
Jenkins ≫ Git Version 0.7.3 SwPlatform jenkins
Jenkins ≫ Git Version 0.8.0 SwPlatform jenkins
Jenkins ≫ Git Version 0.8.1 SwPlatform jenkins
Jenkins ≫ Git Version 0.8.2 SwPlatform jenkins
Jenkins ≫ Git Version 0.9.0 SwPlatform jenkins
Jenkins ≫ Git Version 0.9.1 SwPlatform jenkins
Jenkins ≫ Git Version 0.9.2 SwPlatform jenkins
Jenkins ≫ Git Version 1.0.0 SwPlatform jenkins
Jenkins ≫ Git Version 1.0.1 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.0 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.1 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.2 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.3 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.4 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.5 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.6 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.7 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.8 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.9 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.10 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.11 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.12 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.13 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.14 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.15 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.16 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.17 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.18 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.19 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.20 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.21 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.22 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.23 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.24 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.25 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.26 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.27 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.28 SwPlatform jenkins
Jenkins ≫ Git Version 1.1.29 SwPlatform jenkins
Jenkins ≫ Git Version 1.2.0 SwPlatform jenkins
Jenkins ≫ Git Version 1.3.0 SwPlatform jenkins
Jenkins ≫ Git Version 1.4.0 SwPlatform jenkins
Jenkins ≫ Git Version 1.5.0 SwPlatform jenkins
Jenkins ≫ Git Version 1.6.0 Update beta-1 SwPlatform jenkins
Jenkins ≫ Git Version 2.0.0 SwPlatform jenkins
Jenkins ≫ Git Version 2.0.0 Update alpha-1 SwPlatform jenkins
Jenkins ≫ Git Version 2.0.0 Update alpha-2 SwPlatform jenkins
Jenkins ≫ Git Version 2.0.0 Update beta-2 SwPlatform jenkins
Jenkins ≫ Git Version 2.0.0 Update beta-3 SwPlatform jenkins
Jenkins ≫ Git Version 2.0.1 SwPlatform jenkins
Jenkins ≫ Git Version 2.0.2 SwPlatform jenkins
Jenkins ≫ Git Version 2.0.3 SwPlatform jenkins
Jenkins ≫ Git Version 2.0.4 SwPlatform jenkins
Jenkins ≫ Git Version 2.1.0 SwPlatform jenkins
Jenkins ≫ Git Version 2.2.0 SwPlatform jenkins
Jenkins ≫ Git Version 2.2.1 SwPlatform jenkins
Jenkins ≫ Git Version 2.2.2 SwPlatform jenkins
Jenkins ≫ Git Version 2.2.3 SwPlatform jenkins
Jenkins ≫ Git Version 2.2.4 SwPlatform jenkins
Jenkins ≫ Git Version 2.2.5 SwPlatform jenkins
Jenkins ≫ Git Version 2.2.6 SwPlatform jenkins
Jenkins ≫ Git Version 2.2.7 SwPlatform jenkins
Jenkins ≫ Git Version 2.2.8 SwPlatform jenkins
Jenkins ≫ Git Version 2.2.9 SwPlatform jenkins
Jenkins ≫ Git Version 2.2.10 SwPlatform jenkins
Jenkins ≫ Git Version 2.2.11 SwPlatform jenkins
Jenkins ≫ Git Version 2.2.12 SwPlatform jenkins
Jenkins ≫ Git Version 2.3.0 SwPlatform jenkins
Jenkins ≫ Git Version 2.3.0 Update beta-1 SwPlatform jenkins
Jenkins ≫ Git Version 2.3.0 Update beta-2 SwPlatform jenkins
Jenkins ≫ Git Version 2.3.0 Update beta-3 SwPlatform jenkins
Jenkins ≫ Git Version 2.3.0 Update beta-4 SwPlatform jenkins
Jenkins ≫ Git Version 2.3.1 SwPlatform jenkins
Jenkins ≫ Git Version 2.3.2 SwPlatform jenkins
Jenkins ≫ Git Version 2.3.3 SwPlatform jenkins
Jenkins ≫ Git Version 2.3.4 SwPlatform jenkins
Jenkins ≫ Git Version 2.3.5 SwPlatform jenkins
Jenkins ≫ Git Version 2.4.0 SwPlatform jenkins
Jenkins ≫ Git Version 2.4.1 SwPlatform jenkins
Jenkins ≫ Git Version 2.4.2 SwPlatform jenkins
Jenkins ≫ Git Version 2.4.3 SwPlatform jenkins
Jenkins ≫ Git Version 2.4.4 SwPlatform jenkins
Jenkins ≫ Git Version 2.5.0 SwPlatform jenkins
Jenkins ≫ Git Version 2.5.0 Update beta-1 SwPlatform jenkins
Jenkins ≫ Git Version 2.5.0 Update beta-2 SwPlatform jenkins
Jenkins ≫ Git Version 2.5.0 Update beta-3 SwPlatform jenkins
Jenkins ≫ Git Version 2.5.0 Update beta-4 SwPlatform jenkins
Jenkins ≫ Git Version 2.5.0 Update beta-5 SwPlatform jenkins
Jenkins ≫ Git Version 2.5.1 SwPlatform jenkins
Jenkins ≫ Git Version 2.5.2 SwPlatform jenkins
Jenkins ≫ Git Version 2.5.3 SwPlatform jenkins
Jenkins ≫ Git Version 2.6.0 SwPlatform jenkins
Jenkins ≫ Git Version 2.6.1 SwPlatform jenkins
Jenkins ≫ Git Version 2.6.2 SwPlatform jenkins
Jenkins ≫ Git Version 2.6.2 Update beta-1 SwPlatform jenkins
Jenkins ≫ Git Version 2.6.2 Update beta-2 SwPlatform jenkins
Jenkins ≫ Git Version 2.6.4 SwPlatform jenkins
Jenkins ≫ Git Version 2.6.5 SwPlatform jenkins
Jenkins ≫ Git Version 3.0.0 SwPlatform jenkins
Jenkins ≫ Git Version 3.0.0 Update beta-1 SwPlatform jenkins
Jenkins ≫ Git Version 3.0.0 Update beta-2 SwPlatform jenkins
Jenkins ≫ Git Version 3.0.1 SwPlatform jenkins
Jenkins ≫ Git Version 3.0.2 SwPlatform jenkins
Jenkins ≫ Git Version 3.0.2 Update beta-1 SwPlatform jenkins
Jenkins ≫ Git Version 3.0.2 Update beta-2 SwPlatform jenkins
Jenkins ≫ Git Version 3.0.3 SwPlatform jenkins
Jenkins ≫ Git Version 3.0.4 SwPlatform jenkins
Jenkins ≫ Git Version 3.0.5 SwPlatform jenkins
Jenkins ≫ Git Version 3.1.0 SwPlatform jenkins
Jenkins ≫ Git Version 3.2.0 SwPlatform jenkins
Jenkins ≫ Git Version 3.3.0 SwPlatform jenkins
Jenkins ≫ Git Version 3.3.1 SwPlatform jenkins
Jenkins ≫ Git Version 3.4.0 Update alpha-1 SwPlatform jenkins
Jenkins ≫ Git Version 3.4.0 Update alpha-4 SwPlatform jenkins
Jenkins ≫ Git Version 3.4.0 Update beta-1 SwPlatform jenkins
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.77% 0.507
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 1.6 5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 2.6 4.9 2.9
AV:N/AC:H/Au:N/C:P/I:N/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://jenkins.io/security/advisory/2017-07-10/
Vendor Advisory
http://www.securityfocus.com/bid/100435
Third Party Advisory
VDB Entry