Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

Unknown

Privileges Required

Unknown

Attack Vector

Unknown

CVE-2017-1000092

Disclosure Date: October 05, 2017 •

CVE-2017-1000092

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

None

Impact Score:

Unknown

Exploitability Score:

Unknown

Vector:

Unknown

Attack Vector (AV):

Unknown

Attack Complexity (AC):

Unknown

Privileges Required (PR):

Unknown

User Interaction (UI):

Unknown

Scope (S):

Unknown

Confidentiality (C):

Unknown

Integrity (I):

Unknown

Availability (A):

Unknown

Vendors

jenkins

Products

git 0.1.0,
git 0.2.0,
git 0.3.0,
git 0.4.0,
git 0.5.0,
git 0.6.0,
git 0.7.0,
git 0.7.1,
git 0.7.2,
git 0.7.3,
git 0.8.0,
git 0.8.1,
git 0.8.2,
git 0.9.0,
git 0.9.1,
git 0.9.2,
git 1.0.0,
git 1.0.1,
git 1.1.0,
git 1.1.1,
git 1.1.10,
git 1.1.11,
git 1.1.12,
git 1.1.13,
git 1.1.14,
git 1.1.15,
git 1.1.16,
git 1.1.17,
git 1.1.18,
git 1.1.19,
git 1.1.2,
git 1.1.20,
git 1.1.21,
git 1.1.22,
git 1.1.23,
git 1.1.24,
git 1.1.25,
git 1.1.26,
git 1.1.27,
git 1.1.28,
git 1.1.29,
git 1.1.3,
git 1.1.4,
git 1.1.5,
git 1.1.6,
git 1.1.7,
git 1.1.8,
git 1.1.9,
git 1.2.0,
git 1.3.0,
git 1.4.0,
git 1.5.0,
git 1.6.0,
git 2.0.0,
git 2.0.1,
git 2.0.2,
git 2.0.3,
git 2.0.4,
git 2.1.0,
git 2.2.0,
git 2.2.1,
git 2.2.10,
git 2.2.11,
git 2.2.12,
git 2.2.2,
git 2.2.3,
git 2.2.4,
git 2.2.5,
git 2.2.6,
git 2.2.7,
git 2.2.8,
git 2.2.9,
git 2.3.0,
git 2.3.1,
git 2.3.2,
git 2.3.3,
git 2.3.4,
git 2.3.5,
git 2.4.0,
git 2.4.1,
git 2.4.2,
git 2.4.3,
git 2.4.4,
git 2.5.0,
git 2.5.1,
git 2.5.2,
git 2.5.3,
git 2.6.0,
git 2.6.1,
git 2.6.2,
git 2.6.4,
git 2.6.5,
git 3.0.0,
git 3.0.1,
git 3.0.2,
git 3.0.3,
git 3.0.4,
git 3.0.5,
git 3.1.0,
git 3.2.0,
git 3.3.0,
git 3.3.1,
git 3.4.0

References

Canonical

CVE-2017-1000092 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000092)

BID-100435 (http://www.securityfocus.com/bid/100435)

Advisory

https://jenkins.io/security/advisory/2017-07-10

Rapid7

Unknown

CVE-2017-1000092

Unknown

Unknown

Unknown

Unknown

Unknown

CVE-2017-1000092

Description

Add Assessment

CVSS V3 Severity and Metrics

General Information

Vendors

Products

References

Canonical

Advisory

Additional Info

Technical Analysis

Unknown

CVE-2017-1000092

Unknown

Unknown

Unknown

Unknown

Unknown

CVE-2017-1000092

Description

Add Assessment

CVSS V3 Severity and Metrics

General Information

Vendors

Products

References

Canonical

Advisory

Additional Info

Technical Analysis

Quick Cookie Notification