Incorrect Authorization in Jenkins Git Plugin

MEDIUM 5.3CVE-2018-1000110 · GHSA-46p2-fwqg-3h6m · Published 13/03/2018 · updated 17/06/2026

In short

CVE-2018-1000110 is a MEDIUM (CVSS 5.3) vulnerability affecting org.jenkins-ci.plugins:git, git (jenkins).
Chance of exploitation in the next 30 days (EPSS): 3.9%, higher than 90.3% of all vulnerabilities.
Fix: update to 3.8.0 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:git Maven	`< 3.8.0`	`3.8.0`
git jenkins	`≤ 3.7.0`	No fix yet

Description

An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users.

NVD description

An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users.

References

nvd.nist.gov/vuln/detail/CVE-2018-1000110 · ADVISORY
jenkinsci/git-plugin commit a3d3a7e · WEB
jenkinsci/git-plugin · PACKAGE
jenkins.io/security/advisory/2018-02-26 · WEB

More vulnerabilities in org.jenkins-ci.plugins:git

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:git

Maven

< 3.8.0

3.8.0

git

jenkins

≤ 3.7.0

No fix yet

Description

An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users.

NVD description

An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users.

More vulnerabilities in org.jenkins-ci.plugins:git

See all →