7.5

CVE-2017-1000092

Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.

Data is provided by the National Vulnerability Database (NVD)
Jenkins ≫ Git Version0.1.0 SwPlatformjenkins
Jenkins ≫ Git Version0.2.0 SwPlatformjenkins
Jenkins ≫ Git Version0.3.0 SwPlatformjenkins
Jenkins ≫ Git Version0.4.0 SwPlatformjenkins
Jenkins ≫ Git Version0.5.0 SwPlatformjenkins
Jenkins ≫ Git Version0.6.0 SwPlatformjenkins
Jenkins ≫ Git Version0.7.0 SwPlatformjenkins
Jenkins ≫ Git Version0.7.1 SwPlatformjenkins
Jenkins ≫ Git Version0.7.2 SwPlatformjenkins
Jenkins ≫ Git Version0.7.3 SwPlatformjenkins
Jenkins ≫ Git Version0.8.0 SwPlatformjenkins
Jenkins ≫ Git Version0.8.1 SwPlatformjenkins
Jenkins ≫ Git Version0.8.2 SwPlatformjenkins
Jenkins ≫ Git Version0.9.0 SwPlatformjenkins
Jenkins ≫ Git Version0.9.1 SwPlatformjenkins
Jenkins ≫ Git Version0.9.2 SwPlatformjenkins
Jenkins ≫ Git Version1.0.0 SwPlatformjenkins
Jenkins ≫ Git Version1.0.1 SwPlatformjenkins
Jenkins ≫ Git Version1.1.0 SwPlatformjenkins
Jenkins ≫ Git Version1.1.1 SwPlatformjenkins
Jenkins ≫ Git Version1.1.2 SwPlatformjenkins
Jenkins ≫ Git Version1.1.3 SwPlatformjenkins
Jenkins ≫ Git Version1.1.4 SwPlatformjenkins
Jenkins ≫ Git Version1.1.5 SwPlatformjenkins
Jenkins ≫ Git Version1.1.6 SwPlatformjenkins
Jenkins ≫ Git Version1.1.7 SwPlatformjenkins
Jenkins ≫ Git Version1.1.8 SwPlatformjenkins
Jenkins ≫ Git Version1.1.9 SwPlatformjenkins
Jenkins ≫ Git Version1.1.10 SwPlatformjenkins
Jenkins ≫ Git Version1.1.11 SwPlatformjenkins
Jenkins ≫ Git Version1.1.12 SwPlatformjenkins
Jenkins ≫ Git Version1.1.13 SwPlatformjenkins
Jenkins ≫ Git Version1.1.14 SwPlatformjenkins
Jenkins ≫ Git Version1.1.15 SwPlatformjenkins
Jenkins ≫ Git Version1.1.16 SwPlatformjenkins
Jenkins ≫ Git Version1.1.17 SwPlatformjenkins
Jenkins ≫ Git Version1.1.18 SwPlatformjenkins
Jenkins ≫ Git Version1.1.19 SwPlatformjenkins
Jenkins ≫ Git Version1.1.20 SwPlatformjenkins
Jenkins ≫ Git Version1.1.21 SwPlatformjenkins
Jenkins ≫ Git Version1.1.22 SwPlatformjenkins
Jenkins ≫ Git Version1.1.23 SwPlatformjenkins
Jenkins ≫ Git Version1.1.24 SwPlatformjenkins
Jenkins ≫ Git Version1.1.25 SwPlatformjenkins
Jenkins ≫ Git Version1.1.26 SwPlatformjenkins
Jenkins ≫ Git Version1.1.27 SwPlatformjenkins
Jenkins ≫ Git Version1.1.28 SwPlatformjenkins
Jenkins ≫ Git Version1.1.29 SwPlatformjenkins
Jenkins ≫ Git Version1.2.0 SwPlatformjenkins
Jenkins ≫ Git Version1.3.0 SwPlatformjenkins
Jenkins ≫ Git Version1.4.0 SwPlatformjenkins
Jenkins ≫ Git Version1.5.0 SwPlatformjenkins
Jenkins ≫ Git Version1.6.0 Updatebeta-1 SwPlatformjenkins
Jenkins ≫ Git Version2.0.0 SwPlatformjenkins
Jenkins ≫ Git Version2.0.0 Updatealpha-1 SwPlatformjenkins
Jenkins ≫ Git Version2.0.0 Updatealpha-2 SwPlatformjenkins
Jenkins ≫ Git Version2.0.0 Updatebeta-2 SwPlatformjenkins
Jenkins ≫ Git Version2.0.0 Updatebeta-3 SwPlatformjenkins
Jenkins ≫ Git Version2.0.1 SwPlatformjenkins
Jenkins ≫ Git Version2.0.2 SwPlatformjenkins
Jenkins ≫ Git Version2.0.3 SwPlatformjenkins
Jenkins ≫ Git Version2.0.4 SwPlatformjenkins
Jenkins ≫ Git Version2.1.0 SwPlatformjenkins
Jenkins ≫ Git Version2.2.0 SwPlatformjenkins
Jenkins ≫ Git Version2.2.1 SwPlatformjenkins
Jenkins ≫ Git Version2.2.2 SwPlatformjenkins
Jenkins ≫ Git Version2.2.3 SwPlatformjenkins
Jenkins ≫ Git Version2.2.4 SwPlatformjenkins
Jenkins ≫ Git Version2.2.5 SwPlatformjenkins
Jenkins ≫ Git Version2.2.6 SwPlatformjenkins
Jenkins ≫ Git Version2.2.7 SwPlatformjenkins
Jenkins ≫ Git Version2.2.8 SwPlatformjenkins
Jenkins ≫ Git Version2.2.9 SwPlatformjenkins
Jenkins ≫ Git Version2.2.10 SwPlatformjenkins
Jenkins ≫ Git Version2.2.11 SwPlatformjenkins
Jenkins ≫ Git Version2.2.12 SwPlatformjenkins
Jenkins ≫ Git Version2.3.0 SwPlatformjenkins
Jenkins ≫ Git Version2.3.0 Updatebeta-1 SwPlatformjenkins
Jenkins ≫ Git Version2.3.0 Updatebeta-2 SwPlatformjenkins
Jenkins ≫ Git Version2.3.0 Updatebeta-3 SwPlatformjenkins
Jenkins ≫ Git Version2.3.0 Updatebeta-4 SwPlatformjenkins
Jenkins ≫ Git Version2.3.1 SwPlatformjenkins
Jenkins ≫ Git Version2.3.2 SwPlatformjenkins
Jenkins ≫ Git Version2.3.3 SwPlatformjenkins
Jenkins ≫ Git Version2.3.4 SwPlatformjenkins
Jenkins ≫ Git Version2.3.5 SwPlatformjenkins
Jenkins ≫ Git Version2.4.0 SwPlatformjenkins
Jenkins ≫ Git Version2.4.1 SwPlatformjenkins
Jenkins ≫ Git Version2.4.2 SwPlatformjenkins
Jenkins ≫ Git Version2.4.3 SwPlatformjenkins
Jenkins ≫ Git Version2.4.4 SwPlatformjenkins
Jenkins ≫ Git Version2.5.0 SwPlatformjenkins
Jenkins ≫ Git Version2.5.0 Updatebeta-1 SwPlatformjenkins
Jenkins ≫ Git Version2.5.0 Updatebeta-2 SwPlatformjenkins
Jenkins ≫ Git Version2.5.0 Updatebeta-3 SwPlatformjenkins
Jenkins ≫ Git Version2.5.0 Updatebeta-4 SwPlatformjenkins
Jenkins ≫ Git Version2.5.0 Updatebeta-5 SwPlatformjenkins
Jenkins ≫ Git Version2.5.1 SwPlatformjenkins
Jenkins ≫ Git Version2.5.2 SwPlatformjenkins
Jenkins ≫ Git Version2.5.3 SwPlatformjenkins
Jenkins ≫ Git Version2.6.0 SwPlatformjenkins
Jenkins ≫ Git Version2.6.1 SwPlatformjenkins
Jenkins ≫ Git Version2.6.2 SwPlatformjenkins
Jenkins ≫ Git Version2.6.2 Updatebeta-1 SwPlatformjenkins
Jenkins ≫ Git Version2.6.2 Updatebeta-2 SwPlatformjenkins
Jenkins ≫ Git Version2.6.4 SwPlatformjenkins
Jenkins ≫ Git Version2.6.5 SwPlatformjenkins
Jenkins ≫ Git Version3.0.0 SwPlatformjenkins
Jenkins ≫ Git Version3.0.0 Updatebeta-1 SwPlatformjenkins
Jenkins ≫ Git Version3.0.0 Updatebeta-2 SwPlatformjenkins
Jenkins ≫ Git Version3.0.1 SwPlatformjenkins
Jenkins ≫ Git Version3.0.2 SwPlatformjenkins
Jenkins ≫ Git Version3.0.2 Updatebeta-1 SwPlatformjenkins
Jenkins ≫ Git Version3.0.2 Updatebeta-2 SwPlatformjenkins
Jenkins ≫ Git Version3.0.3 SwPlatformjenkins
Jenkins ≫ Git Version3.0.4 SwPlatformjenkins
Jenkins ≫ Git Version3.0.5 SwPlatformjenkins
Jenkins ≫ Git Version3.1.0 SwPlatformjenkins
Jenkins ≫ Git Version3.2.0 SwPlatformjenkins
Jenkins ≫ Git Version3.3.0 SwPlatformjenkins
Jenkins ≫ Git Version3.3.1 SwPlatformjenkins
Jenkins ≫ Git Version3.4.0 Updatealpha-1 SwPlatformjenkins
Jenkins ≫ Git Version3.4.0 Updatealpha-4 SwPlatformjenkins
Jenkins ≫ Git Version3.4.0 Updatebeta-1 SwPlatformjenkins
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.15% 0.363
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 1.6 5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 2.6 4.9 2.9
AV:N/AC:H/Au:N/C:P/I:N/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

http://www.securityfocus.com/bid/100435
Third Party Advisory
VDB Entry