CVE-2017-1000092

Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.

• jenkins git 0.1.0 • jenkins git 0.2.0 • jenkins git 0.3.0 • jenkins git 0.4.0 • jenkins git 0.5.0 • jenkins git 0.6.0 • jenkins git 0.7.0 • jenkins git 0.7.1 • jenkins git 0.7.2 • jenkins git 0.7.3 • jenkins git 0.8.0 • jenkins git 0.8.1 • jenkins git 0.8.2 • jenkins git 0.9.0 • jenkins git 0.9.1 • jenkins git 0.9.2 • jenkins git 1.0.0 • jenkins git 1.0.1 • jenkins git 1.1.0 • jenkins git 1.1.1 • jenkins git 1.1.2 • jenkins git 1.1.3 • jenkins git 1.1.4 • jenkins git 1.1.5 • jenkins git 1.1.6 • jenkins git 1.1.7 • jenkins git 1.1.8 • jenkins git 1.1.9 • jenkins git 1.1.10 • jenkins git 1.1.11 • jenkins git 1.1.12 • jenkins git 1.1.13 • jenkins git 1.1.14 • jenkins git 1.1.15 • jenkins git 1.1.16 • jenkins git 1.1.17 • jenkins git 1.1.18 • jenkins git 1.1.19 • jenkins git 1.1.20 • jenkins git 1.1.21 • jenkins git 1.1.22 • jenkins git 1.1.23 • jenkins git 1.1.24 • jenkins git 1.1.25 • jenkins git 1.1.26 • jenkins git 1.1.27 • jenkins git 1.1.28 • jenkins git 1.1.29 • jenkins git 1.2.0 • jenkins git 1.3.0 • jenkins git 1.4.0 • jenkins git 1.5.0 • jenkins git 1.6.0 • jenkins git 2.0.0 • jenkins git 2.0.1 • jenkins git 2.0.2 • jenkins git 2.0.3 • jenkins git 2.0.4 • jenkins git 2.1.0 • jenkins git 2.2.0 … and 43 more