CVE-2018-1000110: Incorrect Authorization in Jenkins Git Plugin
Summary
CVE-2018-1000110: Incorrect Authorization in Jenkins Git Plugin. Affects org.jenkins-ci.plugins:git versions < 3.8.0. Fixed in 3.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Git Plugin is a popular open-source plugin for the Jenkins automation server that allows users to integrate Git repositories into their Jenkins projects. It provides functionality for cloning, fetching, and pushing to Git repositories. The plugin is widely used in software development and continuous integration workflows.
Vulnerability Detail
The Jenkins Git Plugin version 3.7.0 and earlier are affected by an improper authorization vulnerability. The vulnerability resides in the GitStatus.java file and allows an attacker with network access to obtain a list of nodes and users. This unauthorized access can lead to information disclosure and potential misuse of sensitive data. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict network access to the Jenkins server to trusted sources only. This can be achieved by configuring firewall rules or network access control lists (ACLs) to limit incoming connections to the Jenkins server. By doing so, the risk of unauthorized access and information disclosure can be mitigated.
Conclusion
The Jenkins Git Plugin version 3.7.0 and earlier are affected by an improper authorization vulnerability that allows unauthorized access to a list of nodes and users. To mitigate this vulnerability, it is recommended to upgrade to version 3.8.0 or later. Alternatively, users can restrict network access to the Jenkins server as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:git →
FAQ
The vulnerability allows an attacker with network access to obtain a list of nodes and users in the Jenkins Git Plugin. This can lead to information disclosure and potential misuse of sensitive data.
There is no known exploit available for this vulnerability at the moment. However, it is important to apply the recommended fix or workaround to prevent any potential exploitation.
No, only versions 3.7.0 and earlier are affected by this vulnerability. Users of later versions are not impacted and do not need to take any action.
Yes, the vulnerability can be exploited remotely by an attacker with network access to the Jenkins server. It is important to apply the necessary fixes or workarounds to mitigate the risk.
At the moment, there are no alternative plugins or solutions available for this specific functionality provided by the Jenkins Git Plugin. It is recommended to update to the fixed version or apply the suggested workaround.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:git.
