CVE-2017-1000087: Infoleak
GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000087?
CVE-2017-1000087 is classified as a medium severity vulnerability due to improper permission checks.
How do I fix CVE-2017-1000087?
To fix CVE-2017-1000087, upgrade to a version of Jenkins Github Branch Source that is greater than 2.0.7.
What types of credentials are affected by CVE-2017-1000087?
CVE-2017-1000087 affects all valid credential IDs that can be listed by any user with Overall/Read permission.
Who is affected by CVE-2017-1000087?
Any Jenkins user with Overall/Read permission can exploit CVE-2017-1000087 without needing elevated privileges.
What components does CVE-2017-1000087 impact in Jenkins?
CVE-2017-1000087 specifically impacts the GitHub Branch Source plugin in Jenkins.