Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2017-1000087: GitHub Branch Source Exposes Sensitive Credentials to Unauthorized Users
CVE-2017-1000087 · published 9 years ago
Summary
A flaw in GitHub Branch Source allows anyone with read access to view a list of valid credentials, potentially leading to unauthorized access to sensitive information. This issue affects users who have configured jobs with GitHub Branch Source. To fix this, users should review their permissions and ensure that access to credential IDs is restricted to authorized personnel.
What to do
- Update jenkins-ci org.jenkins-ci.plugins:github-branch-source to version 2.2.0-alpha-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | jenkins-ci | org.jenkins-ci.plugins:github-branch-source |
< 2.2.0-alpha-1 Fix: upgrade to 2.2.0-alpha-1
|
| – | jenkins | github_branch_source |
<= 2.0.7 0.1 1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.8.1 9 more version ranges
cpe:2.3:a:jenkins:github_branch_source:*:*:*:*:*:jenkins:*:* |
Original advisory text
GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any u...
GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-200Information Exposure
Timeline
Published5 Oct 2017
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta