CVE-2018-1000183

CWE-200 — Information ExposureCWE-352 — Cross-Site Request Forgery (CSRF)7 documents7 sources
Severity
6.5MEDIUM
EPSS
0.3%
top 45.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Jenkins Github
Timeline
PublishedJun 5
Latest updateMay 14

Description

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDjenkins/github1.29.0

🔴Vulnerability Details

3
OSV
Jenkins GitHub Plugin exposure of sensitive information vulnerability exists↗2022-05-14
▶
GHSA
Jenkins GitHub Plugin exposure of sensitive information vulnerability exists↗2022-05-14
▶
CVEList
CVE-2018-1000183: A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1↗2018-06-05
▶

📋Vendor Advisories

2
Jenkins
Jenkins Security Advisory 2018-06-04↗2018-06-04
▶
Red Hat
jenkins-plugin-github: CSRF vulnerability and missing permission checks allowed capturing credentials (SECURITY-804)↗2018-06-04
▶

💬Community

1
Bugzilla
CVE-2018-1000183 jenkins-plugin-github: CSRF vulnerability and missing permission checks allowed capturing credentials (SECURITY-804)↗2018-06-05
▶
CVE-2018-1000183 (MEDIUM CVSS 6.5) | A exposure of sensitive information | cvebase.io