Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability

Also known as GHSA-hrwc-pqfm-g6qf

Published 9 y ago 2017-10-04 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.0%

percentile 64%

Public exploits

none known

Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks.

Exploit prediction (EPSS)

1.03% probability of exploitation in the next 30 days, higher than 64% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:P/I:N/A:N`
GitHub	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.jenkins-ci.plugins:subversion`	<2.9	2.9

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

securityfocus.com /bid/99574 · vdb-entry, x_refsource_BID, x_transferred
jenkins.io /security/advisory/2017-07-10/ · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-1000085 · advisory
github.com /jenkinsci/subversion-plugin · package
jenkins.io /security/advisory/2017-07-10 · web
web.archive.org /web/20171119065136/http://www.securityfocus.com/bid/99574 · web

Sources

CVE List: CVE-2017-1000085
GitHub Advisory: GHSA-hrwc-pqfm-g6qf
NVD: CVE-2017-1000085

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.