CVE-2017-1000085
published 2017-10-05CVE-2017-1000085: Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality…
PriorityP432medium6.5CVSS 3.0
AVNACLPRNUIRSUCHINAN
EPSS
1.03%
63.5th percentile
Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | build_step_plugin | — | — |
| jenkins | credentials_plugin | — | — |
| jenkins | docker_commons_plugin | — | — |
| jenkins | git_plugin | — | — |
| jenkins | github_branch_source_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | ids_in_docker_commons_plugin | — | — |
| jenkins | ids_in_github_branch_source_plugin | — | — |
| jenkins | parameterized_trigger_plugin | — | — |
| jenkins | periodic_backup_plugin | — | — |
| jenkins | plugins_like_authorize_project_plugin | — | — |
| jenkins | poll_scm_plugin | — | — |
| jenkins | role-based_authorization_strategy_plugin | — | — |
| jenkins | script_security_plugin | — | — |
| jenkins | sidebar_link_plugin | — | — |
| jenkins | ssh_plugin | — | — |
| jenkins | subversion | <= 2.8 | — |
| jenkins | subversion_plugin | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
jenkins-plugin-subversion: CSRF vulnerability and insufficient permission checks allow capturing credentials (SECURITY-303)
vendor_redhat·2017-07-10·CVSS 6.5
CVE-2017-1000085 [MEDIUM] CWE-352 jenkins-plugin-subversion: CSRF vulnerability and insufficient permission checks allow capturing credentials (SECURITY-303)
jenkins-plugin-subversion: CSRF vulnerability and insufficient permission checks allow capturing credentials (SECURITY-303)
Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks.
Subversion Plugin improperly checked permissions, requiring just Item/Build instead of Item/Configure when used.
Jenkins
Jenkins Security Advisory 2017-07-10
vendor_jenkins·2017-07-10·CVSS 6.5
CVE-2017-1000084 [MEDIUM] Jenkins Security Advisory 2017-07-10
Title: Jenkins Security Advisory 2017-07-10
Jenkins Security Advisory 2017-07-10
This advisory originally recommended upgrading Poll SCM plugin to version 1.4. This was incorrect. Version 1.3.1 contains the fix.
This advisory announces vulnerabilities in these Jenkins plugins:
Docker Commons Plugin
Git Plugin
GitHub Branch Source Plugin
Parameterized Trigger Plugin
Periodic Backup Plugin
Pipeline: Build Step Plugin
Pipeline: Groovy Plugin
Poll SCM Plugin
Role-based Authorization Strategy Plugin
Script Security Plugin
Sidebar Link Plugin
SSH Plugin
Subversion Plugin
Description
Parameterized Trigger Plugin fails to check Item/Build permission
SECURITY-201 / CVE-2017-1000084
Builds in Jenkins are a
OSV
Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability
osv·2022-05-17
CVE-2017-1000085 [MEDIUM] Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability
Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability
Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks. As of version 2.9, this functionality properly checks permissions and is only available via POST.
GHSA
Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability
ghsa·2022-05-17
CVE-2017-1000085 [MEDIUM] CWE-352 Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability
Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability
Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks. As of version 2.9, this functionality properly checks permissions and is only available via POST.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-1000085 clamav: Out-of-bounds heap read in XAR parser
bugzilla·2018-02-26·CVSS 5.5
CVE-2018-1000085 [MEDIUM] CVE-2018-1000085 clamav: Out-of-bounds heap read in XAR parser
CVE-2018-1000085 clamav: Out-of-bounds heap read in XAR parser
An out-of-bounds heap read vulnerability was found in XAR parser that leads to clamscan crash when invoked on malicious XAR file.
Upstream patch:
https://github.com/Cisco-Talos/clamav-devel/commit/d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6
Reference:
http://www.openwall.com/lists/oss-security/2017/09/29/4
Discussion:
Created clamav tracking bugs for this issue:
Affects: epel-all [bug 1549070]
Affects: fedora-all [bug 1549071]
Bugzilla
CVE-2017-1000085 jenkins-plugin-subversion: CSRF vulnerability and insufficient permission checks allow capturing credentials (SECURITY-303)
bugzilla·2017-07-14·CVSS 6.5
CVE-2017-1000085 [MEDIUM] CVE-2017-1000085 jenkins-plugin-subversion: CSRF vulnerability and insufficient permission checks allow capturing credentials (SECURITY-303)
CVE-2017-1000085 jenkins-plugin-subversion: CSRF vulnerability and insufficient permission checks allow capturing credentials (SECURITY-303)
Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags).
This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them.
Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks.
External References:
https://jenkins.io/security/advisory/2017-07-10/
Discussion:
Acknowled
2017-10-05
Published