GHSA-46p2-fwqg-3h6m

Incorrect Authorization in Jenkins Git Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000110

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:git	< 3.8.0	3.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000110 advisory
https://github.com/jenkinsci/git-plugin/commit/a3d3a7eb7f75bfe97a0291e3b6d074aafafa86c9 web
https://github.com/jenkinsci/git-plugin package
https://jenkins.io/security/advisory/2018-02-26/#SECURITY-723 web