CVE-2017-1000085

CWE-352 — Cross-Site Request Forgery (CSRF)8 documents7 sources
Severity
6.5MEDIUM
EPSS
0.1%
top 65.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Jenkins Subversion
Timeline
PublishedOct 5
Latest updateMay 17

Description

Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without dire…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

3
OSV
Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability↗2022-05-17
▶
GHSA
Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability↗2022-05-17
▶
CVEList
CVE-2017-1000085: Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e↗2017-10-04
▶

📋Vendor Advisories

2
Red Hat
jenkins-plugin-subversion: CSRF vulnerability and insufficient permission checks allow capturing credentials (SECURITY-303)↗2017-07-10
▶
Jenkins
Jenkins Security Advisory 2017-07-10↗2017-07-10
▶

💬Community

2
Bugzilla
CVE-2018-1000085 clamav: Out-of-bounds heap read in XAR parser↗2018-02-26
▶
Bugzilla
CVE-2017-1000085 jenkins-plugin-subversion: CSRF vulnerability and insufficient permission checks allow capturing credentials (SECURITY-303)↗2017-07-14
▶
CVE-2017-1000085 (MEDIUM CVSS 6.5) | Subversion Plugin connects to a use | cvebase.io