daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update CVE-2018-1000600.yaml

patch-1
Prince Chaddha 2022-06-20 21:24:13 +05:30 committed by GitHub
parent e0f39583d2
commit aa3e6b24a7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
cves/2018/CVE-2018-1000600.yaml
View File

@ -4,7 +4,8 @@ info:
name: Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery
author: geeknik
severity: high
description: Jenkins GitHub Plugin 1.29.1 and earlier is susceptible to server-side request forgery via GitHubTokenCredentialsCreator.java, which allows attackers to leverage attacker-specified credentials IDs obtained through another method and capture the credentials stored in Jenkins.
description: |
Jenkins GitHub Plugin 1.29.1 and earlier is susceptible to server-side request forgery via GitHubTokenCredentialsCreator.java, which allows attackers to leverage attacker-specified credentials IDs obtained through another method and capture the credentials stored in Jenkins.
reference:
- https://www.jenkins.io/security/advisory/2018-06-25/#SECURITY-915
- https://devco.re/blog/2019/01/16/hacking-Jenkins-part1-play-with-dynamic-routing/
@ -15,7 +16,7 @@ info:
cvss-score: 8.8
cve-id: CVE-2018-1000600
cwe-id: CWE-200
tags: cve,cve2018,jenkins,ssrf,oast
tags: cve,cve2018,jenkins,ssrf,oast,github
requests:
- method: GET