CVE-2018-1000600 in jenkins github
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected software: jenkins github
Scores
- CVSS: 8.8 (high)
- EPSS: 90.89% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2018-06-26
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): No
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.