GCVE - cpe:2.3:a:jenkins:github_branch_source:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:github_branch_source:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Github Branch Source (`c6f54066-8d57-50c5-a436-4404bbc22c4d`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-42522`	vulnerable	2026-06-08 08:03:16.463515	Details available A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials. Published: 2026-04-29T13:31:31.337Z Updated: 2026-04-29T14:28:32.781Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3702	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-23903`	vulnerable	2026-06-08 06:29:40.843352	Details available Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token. Published: 2024-01-24T17:52:26.696Z Updated: 2025-02-13T17:39:59.383Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-2871 http://www.openwall.com/lists/oss-security/2024/01/24/6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-23902`	vulnerable	2026-06-08 06:29:40.842804	Details available A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL. Published: 2024-01-24T17:52:26.044Z Updated: 2025-05-30T14:16:31.521Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3251 http://www.openwall.com/lists/oss-security/2024/01/24/6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-23901`	vulnerable	2026-06-08 06:29:40.841996	Details available Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group. Published: 2024-01-24T17:52:25.415Z Updated: 2025-05-30T14:16:37.683Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3040 http://www.openwall.com/lists/oss-security/2024/01/24/6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-1000185`	vulnerable	2026-06-08 05:10:25.613570	Details available A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. Published: 2018-06-05T20:00:00.000Z Updated: 2024-09-16T22:14:09.790Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2018-06-04/#SECURITY-806	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-1000087`	vulnerable	2026-06-08 05:08:33.831321	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.