Detections
Analytics

SCA: security update for org.jenkins-ci.plugins:github-branch-source (GHSA-w66r-f5gg-gqwm)

medium Tenable Self-Hosted Container Security Plugin ID 419739

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part
 of form validation and completion (e.g. to verify Scan Credentials are correct). This functionality
 improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect to any
 web server and send credentials with a known ID, thereby possibly capturing them. Additionally, this
 functionality did not require POST requests be used, thereby allowing the above to be performed without
 direct access to Jenkins via Cross-Site Request Forgery. (CVE-2017-1000091)

See Also

https://github.com/advisories/GHSA-w66r-f5gg-gqwm

Plugin Details

Severity: Medium

ID: 419739

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.8

Percentile: 22.22

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2017-1000091

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/17/2022

Vulnerability Publication Date: 7/10/2017

Reference Information

CVE: CVE-2017-1000091

BID: 100434

cwe: CWE-352