CVE-2017-1000092: CSRF

Published Oct 4, 2017

Updated

Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.

Affected Software

124 affected components

jenkins Git Jenkins=0.1.0

jenkins Git Jenkins=0.2.0

jenkins Git Jenkins=0.3.0

jenkins Git Jenkins=0.4.0

jenkins Git Jenkins=0.5.0

jenkins Git Jenkins=0.6.0

jenkins Git Jenkins=0.7.0

jenkins Git Jenkins=0.7.1

jenkins Git Jenkins=0.7.2

jenkins Git Jenkins=0.7.3

jenkins Git Jenkins=0.8.0

jenkins Git Jenkins=0.8.1

jenkins Git Jenkins=0.8.2

jenkins Git Jenkins=0.9.0

jenkins Git Jenkins=0.9.1

jenkins Git Jenkins=0.9.2

jenkins Git Jenkins=1.0.0

jenkins Git Jenkins=1.0.1

jenkins Git Jenkins=1.1.0

jenkins Git Jenkins=1.1.1

jenkins Git Jenkins=1.1.2

jenkins Git Jenkins=1.1.3

jenkins Git Jenkins=1.1.4

jenkins Git Jenkins=1.1.5

jenkins Git Jenkins=1.1.6

jenkins Git Jenkins=1.1.7

jenkins Git Jenkins=1.1.8

jenkins Git Jenkins=1.1.9

jenkins Git Jenkins=1.1.10

jenkins Git Jenkins=1.1.11

jenkins Git Jenkins=1.1.12

jenkins Git Jenkins=1.1.13

jenkins Git Jenkins=1.1.14

jenkins Git Jenkins=1.1.15

jenkins Git Jenkins=1.1.16

jenkins Git Jenkins=1.1.17

jenkins Git Jenkins=1.1.18

jenkins Git Jenkins=1.1.19

jenkins Git Jenkins=1.1.20

jenkins Git Jenkins=1.1.21

jenkins Git Jenkins=1.1.22

jenkins Git Jenkins=1.1.23

jenkins Git Jenkins=1.1.24

jenkins Git Jenkins=1.1.25

jenkins Git Jenkins=1.1.26

jenkins Git Jenkins=1.1.27

jenkins Git Jenkins=1.1.28

jenkins Git Jenkins=1.1.29

jenkins Git Jenkins=1.2.0

jenkins Git Jenkins=1.3.0

jenkins Git Jenkins=1.4.0

jenkins Git Jenkins=1.5.0

jenkins Git Jenkins=1.6.0-beta-1

jenkins Git Jenkins=2.0.0

jenkins Git Jenkins=2.0.0-alpha-1

jenkins Git Jenkins=2.0.0-alpha-2

jenkins Git Jenkins=2.0.0-beta-2

jenkins Git Jenkins=2.0.0-beta-3

jenkins Git Jenkins=2.0.1

jenkins Git Jenkins=2.0.2

jenkins Git Jenkins=2.0.3

jenkins Git Jenkins=2.0.4

jenkins Git Jenkins=2.1.0

jenkins Git Jenkins=2.2.0

jenkins Git Jenkins=2.2.1

jenkins Git Jenkins=2.2.2

jenkins Git Jenkins=2.2.3

jenkins Git Jenkins=2.2.4

jenkins Git Jenkins=2.2.5

jenkins Git Jenkins=2.2.6

jenkins Git Jenkins=2.2.7

jenkins Git Jenkins=2.2.8

jenkins Git Jenkins=2.2.9

jenkins Git Jenkins=2.2.10

jenkins Git Jenkins=2.2.11

jenkins Git Jenkins=2.2.12

jenkins Git Jenkins=2.3.0

jenkins Git Jenkins=2.3.0-beta-1

jenkins Git Jenkins=2.3.0-beta-2

jenkins Git Jenkins=2.3.0-beta-3

jenkins Git Jenkins=2.3.0-beta-4

jenkins Git Jenkins=2.3.1

jenkins Git Jenkins=2.3.2

jenkins Git Jenkins=2.3.3

jenkins Git Jenkins=2.3.4

jenkins Git Jenkins=2.3.5

jenkins Git Jenkins=2.4.0

jenkins Git Jenkins=2.4.1

jenkins Git Jenkins=2.4.2

jenkins Git Jenkins=2.4.3

jenkins Git Jenkins=2.4.4

jenkins Git Jenkins=2.5.0

jenkins Git Jenkins=2.5.0-beta-1

jenkins Git Jenkins=2.5.0-beta-2

jenkins Git Jenkins=2.5.0-beta-3

jenkins Git Jenkins=2.5.0-beta-4

jenkins Git Jenkins=2.5.0-beta-5

jenkins Git Jenkins=2.5.1

jenkins Git Jenkins=2.5.2

jenkins Git Jenkins=2.5.3

jenkins Git Jenkins=2.6.0

jenkins Git Jenkins=2.6.1

jenkins Git Jenkins=2.6.2

jenkins Git Jenkins=2.6.2-beta-1

jenkins Git Jenkins=2.6.2-beta-2

jenkins Git Jenkins=2.6.4

jenkins Git Jenkins=2.6.5

jenkins Git Jenkins=3.0.0

jenkins Git Jenkins=3.0.0-beta-1

jenkins Git Jenkins=3.0.0-beta-2

jenkins Git Jenkins=3.0.1

jenkins Git Jenkins=3.0.2

jenkins Git Jenkins=3.0.2-beta-1

jenkins Git Jenkins=3.0.2-beta-2

jenkins Git Jenkins=3.0.3

jenkins Git Jenkins=3.0.4

jenkins Git Jenkins=3.0.5

jenkins Git Jenkins=3.1.0

jenkins Git Jenkins=3.2.0

jenkins Git Jenkins=3.3.0

jenkins Git Jenkins=3.3.1

jenkins Git Jenkins=3.4.0-alpha-1

jenkins Git Jenkins=3.4.0-alpha-4

jenkins Git Jenkins=3.4.0-beta-1

Event History

Oct 4, 2017

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2017-1000092?

The severity of CVE-2017-1000092 is classified as Medium.

How do I fix CVE-2017-1000092?

To fix CVE-2017-1000092, upgrade to the latest version of the Jenkins Git plugin.

What versions are affected by CVE-2017-1000092?

CVE-2017-1000092 affects Jenkins Git plugin versions from 0.1.0 to 3.4.0-beta-1.

What type of attack does CVE-2017-1000092 allow?

CVE-2017-1000092 allows an attacker to perform a cross-site request forgery through crafted links.

Has CVE-2017-1000092 been exploited in the wild?

There is currently no evidence that CVE-2017-1000092 has been actively exploited in the wild.