{"id":"CVE-2017-1000091","details":"GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan Credentials are correct). This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect to any web server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery.","aliases":["GHSA-w66r-f5gg-gqwm"],"modified":"2026-07-08T12:54:01.583327Z","published":"2017-10-05T01:29:03.743Z","references":[{"type":"ADVISORY","url":"https://jenkins.io/security/advisory/2017-07-10/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/github-branch-source-plugin","events":[{"introduced":"5e2f4e75243820e6925b74efb783eba652809b66"},{"last_affected":"f2d5f8864a1cf62e67195aedd9222f5a806f7237"}],"database_specific":{"cpe":["cpe:2.3:a:jenkins:github_branch_source:0.1:beta-1:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:0.1:beta-2:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:0.1:beta-3:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:0.1:beta-4:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:1.0:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:1.1:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:1.2:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:1.3:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:1.4:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:1.4:beta-1:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:1.5:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:1.6:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:1.7:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:1.8:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:1.8.1:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:1.9:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:1.10:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.0:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.0:beta-1:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.0:beta-2:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.1:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.1:beta-1:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.1:beta-2:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.1:beta-3:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.1:beta-4:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.1:beta-5:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.1:beta-6:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.2:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.3:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.4:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.4:beta-1:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.5:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.6:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.0.7:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.2.0:alpha-1:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.2.0:alpha-2:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.2.0:alpha-3:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.2.0:alpha-4:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:github_branch_source:2.2.0:beta-1:*:*:*:jenkins:*:*"],"extracted_events":[{"introduced":"0.1-beta\\-1"},{"last_affected":"0.1-beta\\-1"},{"introduced":"0.1-beta\\-2"},{"last_affected":"0.1-beta\\-2"},{"introduced":"0.1-beta\\-3"},{"last_affected":"0.1-beta\\-3"},{"introduced":"0.1-beta\\-4"},{"last_affected":"0.1-beta\\-4"},{"introduced":"1.0"},{"last_affected":"1.0"},{"introduced":"1.1"},{"last_affected":"1.1"},{"introduced":"1.2"},{"last_affected":"1.2"},{"introduced":"1.3"},{"last_affected":"1.3"},{"introduced":"1.4"},{"last_affected":"1.4"},{"introduced":"1.4-beta\\-1"},{"last_affected":"1.4-beta\\-1"},{"introduced":"1.5"},{"last_affected":"1.5"},{"introduced":"1.6"},{"last_affected":"1.6"},{"introduced":"1.7"},{"last_affected":"1.7"},{"introduced":"1.8"},{"last_affected":"1.8"},{"introduced":"1.8.1"},{"last_affected":"1.8.1"},{"introduced":"1.9"},{"last_affected":"1.9"},{"introduced":"1.10"},{"last_affected":"1.10"},{"introduced":"2.0.0"},{"last_affected":"2.0.0"},{"introduced":"2.0.0-beta\\-1"},{"last_affected":"2.0.0-beta\\-1"},{"introduced":"2.0.0-beta\\-2"},{"last_affected":"2.0.0-beta\\-2"},{"introduced":"2.0.1"},{"last_affected":"2.0.1"},{"introduced":"2.0.1-beta\\-1"},{"last_affected":"2.0.1-beta\\-1"},{"introduced":"2.0.1-beta\\-2"},{"last_affected":"2.0.1-beta\\-2"},{"introduced":"2.0.1-beta\\-3"},{"last_affected":"2.0.1-beta\\-3"},{"introduced":"2.0.1-beta\\-4"},{"last_affected":"2.0.1-beta\\-4"},{"introduced":"2.0.1-beta\\-5"},{"last_affected":"2.0.1-beta\\-5"},{"introduced":"2.0.1-beta\\-6"},{"last_affected":"2.0.1-beta\\-6"},{"introduced":"2.0.2"},{"last_affected":"2.0.2"},{"introduced":"2.0.3"},{"last_affected":"2.0.3"},{"introduced":"2.0.4"},{"last_affected":"2.0.4"},{"introduced":"2.0.4-beta\\-1"},{"last_affected":"2.0.4-beta\\-1"},{"introduced":"2.0.5"},{"last_affected":"2.0.5"},{"introduced":"2.0.6"},{"last_affected":"2.0.6"},{"introduced":"2.0.7"},{"last_affected":"2.0.7"},{"introduced":"2.2.0-alpha\\-1"},{"last_affected":"2.2.0-alpha\\-1"},{"introduced":"2.2.0-alpha\\-2"},{"last_affected":"2.2.0-alpha\\-2"},{"introduced":"2.2.0-alpha\\-3"},{"last_affected":"2.2.0-alpha\\-3"},{"introduced":"2.2.0-alpha\\-4"},{"last_affected":"2.2.0-alpha\\-4"},{"introduced":"2.2.0-beta\\-1"},{"last_affected":"2.2.0-beta\\-1"}],"source":"CPE_STRING"}}],"versions":["0.1-beta\\-1","0.1-beta\\-2","0.1-beta\\-3","0.1-beta\\-4","1.0","1.1","1.10","1.2","1.3","1.4","1.4-beta\\-1","1.5","1.6","1.7","1.8","1.8.1","1.9","2.0.0","2.0.0-beta\\-1","2.0.0-beta\\-2","2.0.1","2.0.1-beta\\-1","2.0.1-beta\\-2","2.0.1-beta\\-3","2.0.1-beta\\-4","2.0.1-beta\\-5","2.0.1-beta\\-6","2.0.2","2.0.3","2.0.4","2.0.4-beta\\-1","2.0.5","2.0.6","2.0.7","2.2.0-alpha\\-1","2.2.0-alpha\\-2","2.2.0-alpha\\-3","2.2.0-alpha\\-4","2.2.0-beta\\-1","github-branch-source-2.2.0-beta-1","github-branch-source-2.0.7","github-branch-source-2.0.6","github-branch-source-2.0.5","github-branch-source-2.0.4","github-branch-source-2.0.4-beta-1","github-branch-source-2.0.3","github-branch-source-2.0.2","github-branch-source-2.0.1","github-branch-source-2.0.1-beta-6","github-branch-source-2.0.1-beta-5","github-branch-source-2.0.1-beta-4","github-branch-source-2.0.1-beta-3","github-branch-source-2.0.1-beta-2","github-branch-source-2.0.1-beta-1","github-branch-source-2.0.0","github-branch-source-2.0.0-beta-2","github-branch-source-2.0.0-beta-1","github-branch-source-1.10","github-branch-source-1.9","github-branch-source-1.8.1","github-branch-source-1.8","github-branch-source-1.7","github-branch-source-1.6","github-branch-source-1.5","github-branch-source-1.4","github-branch-source-1.4-beta-1","github-branch-source-1.3","github-branch-source-1.2","github-branch-source-1.1","github-branch-source-1.0","github-branch-source-0.1-beta-4","github-branch-source-0.1-beta-3","github-branch-source-0.1-beta-2","github-branch-source-0.1-beta-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000091.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}