PT-2017-10799 · Docker+1 · Docker Commons Plugin+1

Karl Shultz · Published 2017-10-04 · Updated 2022-05-17 · CVE-2017-1000094

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Docker Commons Plugin (affected versions not specified)

Description The Docker Commons Plugin has a functionality that provides a list of applicable credential IDs for users to select when configuring a job to authenticate with a Docker Registry. However, this functionality did not check permissions, allowing any user with Overall/Read permission to obtain a list of valid credential IDs. These IDs could potentially be used as part of an attack to capture credentials using another vulnerability.

Recommendations To resolve the issue, ensure that the permission to enumerate credentials IDs in the Docker Commons Plugin requires Extended Read permission (when enabled) or Configure permission to the job in whose context credentials are being accessed. If no job context exists, require Overall/Administer permission. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-1000094

GHSA-69CJ-G7MW-MH72

Affected Products

Docker Commons Plugin

Jenkins

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000094 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1000094 · Vendor Advisory
• https://jenkins.io/security/advisory/2017-07-10 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-69cj-g7mw-mh72 · Vendor Advisory
• https://github.com/jenkinsci/docker-commons-plugin/commit/07ddeff5331687db364d681504117b4e8b2dde6a · Note
• https://github.com/jenkinsci/docker-commons-plugin · Note