CVE-2017-1000085

Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks.

• CWE-352

• http://www.securityfocus.com/bid/99574Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2017-07-10/Vendor Advisory
• http://www.securityfocus.com/bid/99574Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2017-07-10/Vendor Advisory

Published

Oct 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000079Linux foundation ONOS 1.9.0 is vulnerable to a DoS.7.5
• CVE-2017-1000080Linux foundation ONOS 1.9.0 allows unauthenticated use of we…7.5
• CVE-2017-1000081Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated…9.8
• CVE-2017-1000082systemd v233 and earlier fails to safely parse usernames sta…9.8
• CVE-2017-1000083backend/comics/comics-document.c (aka the comic book backend…
• CVE-2017-1000084Parameterized Trigger Plugin fails to check Item/Build permi…
• CVE-2017-1000086The Periodic Backup Plugin did not perform any permission ch…
• CVE-2017-1000087GitHub Branch Source provides a list of applicable credentia…
• CVE-2017-1000088The Sidebar Link plugin allows users able to configure jobs,…
• CVE-2017-1000089Builds in Jenkins are associated with an authentication that…
• CVE-2017-1000090Role-based Authorization Strategy Plugin was not requiring r…
• CVE-2017-1000091GitHub Branch Source Plugin connects to a user-specified Git…