CVE-2018-1000186 Jenkins GitHub Pull Request Builder Plugin credential capture vulnerability

Medium 6.5 Published 5 Jun 2018 Updated 16 Sep 2024

Attackers with read access can force Jenkins to send stored credentials to an attacker-controlled URL, exposing sensitive authentication data.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-1000186?

CVE-2018-1000186 is a medium-severity vulnerability in n/a, published on 5 Jun 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Weakness: CWE-200

Which versions are affected by CVE-2018-1000186?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:ghprb. It affects 1 product.

Package	Affected	Fixed in
`org.jenkins-ci.plugins:ghprb` Maven	All versions	`1.42.0`
`org.jenkins-ci.plugins:ghprb` Maven	All versions	`1.42.0`

Products include Jenkins Github Pull Request Builder.

How do I fix CVE-2018-1000186?

Upgrade org.jenkins-ci.plugins:ghprb to 1.42.0 or later.

Is CVE-2018-1000186 being exploited?

There is no known exploitation of CVE-2018-1000186 in the wild and no public exploit code.

Sources

Also known as GHSA-92rv-mvmj-47qh.