Git Plugin for Jenkins is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.
The following products are affected:
Git Plugin 3.3.1 and prior.
Git Plugin 2.4.0-beta-1 and prior.
Information
Jenkins-Ci Git plugin 3.3.1
Jenkins-Ci Git plugin 2.4.0-beta-1
Jenkins-Ci Git plugin 3.4.0-beta-2
Exploit
To exploit this issue, an attacker must entice an unsuspecting victim to follow a malicious URI.
References:
- CVE-2017-1000092 (Redhat)
- Jenkins CI Homepage (Jenkins CI)
- Bug 1471053 - (CVE-2017-1000092) CVE-2017-1000092 jenkins-plugin-git: CSRF vuln (Redhat)
- Jenkins Security Advisory 2017-07-10 (Jenkins)