Medium severity6.5NVD Advisory· Published Oct 5, 2017· Updated May 13, 2026
CVE-2017-1000085
CVE-2017-1000085
Description
Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:subversionMaven | < 2.9 | 2.9 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- www.securityfocus.com/bid/99574nvdThird Party AdvisoryVDB Entry
- github.com/advisories/GHSA-hrwc-pqfm-g6qfghsaADVISORY
- jenkins.io/security/advisory/2017-07-10/nvdVendor Advisory
- nvd.nist.gov/vuln/detail/CVE-2017-1000085ghsaADVISORY
- jenkins.io/security/advisory/2017-07-10ghsaWEB
- web.archive.org/web/20171119065136/http://www.securityfocus.com/bid/99574ghsaWEB
News mentions
0No linked articles in our index yet.