~ / search / GHSA-8vg7-gh73-866v

GHSA-8vg7-gh73-866v

Jenkins Accurev Plugin CSRF vulnerability and missing permission checks

Source: GitHub Advisory Database (reviewed) High CVE-2018-1999028

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:accurev < 0.7.17 0.7.17

Details

As written in the advisory (Markdown source, shown as plain text).

An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.

References

External links from the advisory. They lead to third-party sites.