CVE-2018-1000142
Description
Jenkins GitHub Pull Request Builder Plugin stores GitHub credentials in serialized objects in build.xml, allowing local file system access.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Jenkins GitHub Pull Request Builder Plugin stores GitHub credentials in serialized objects in build.xml, allowing local file system access.
Vulnerability
GitHub Pull Request Builder Plugin (ghprb) versions 1.39.0 and older store serialized objects in build.xml files that contain the GitHub access token used to poll Jenkins [1][2]. This allows users with access to the Jenkins controller file system to retrieve GitHub credentials.
Exploitation
An attacker needs local file system access to the Jenkins controller to read the build.xml files where the serialized credential is stored. No special authentication or user interaction is required beyond having file read permissions on the Jenkins master.
Impact
Successful exploitation results in exposure of GitHub credentials (access tokens) stored by the plugin, allowing the attacker to impersonate the Jenkins instance on GitHub, potentially accessing private repositories or performing unauthorized actions.
Mitigation
The vulnerability is fixed in GitHub Pull Request Builder Plugin version 1.40.0, which no longer stores serialized objects containing the credential on disk [2]. Users should upgrade to version 1.40.0 or later. The plugin is deprecated and replaced by the GitHub Branch Source Plugin; migration is recommended [1].
AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:ghprbMaven | < 1.40.0 | 1.40.0 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/advisories/GHSA-hr74-2j5v-ghfvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-1000142ghsaADVISORY
- jenkins.io/security/advisory/2018-03-26/ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.