CVE-2018-1000600 is a high-severity (CVSS 8.8) Information Exposure vulnerability in com.coravy.hudson.plugins.github:github. 1 public exploit reference exists, so weaponization risk is real. A fix is available for com.coravy.hudson.plugins.github:github — see the affected versions and patch details below.
CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2018-1000600 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).
Where this sits among everything scored
Of 395,249 CVEs with a current EPSS score, this one falls in the ≥ 90% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
com.coravy.hudson.plugins.github:githubReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | com.coravy.hudson.plugins.github:github | all versions | 1.29.2com.coravy.hudson.plugins.github:github:1.29.2 |
Affected Products
githubjenkinsResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.coravy.hudson.plugins.github:github, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update com.coravy.hudson.plugins.github:github to 1.29.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2018-1000600 is resolved across your whole dependency graph.
Workarounds
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.
How to detect CVE-2018-1000600
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id cve-2018-1000600 -u https://target- Template
- Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery
- Severity
- high
- Impact
- Successful exploitation of this vulnerability can lead to unauthorized access to internal resources, potential data leakage, and further attacks on the network.
- Remediation
- Upgrade Jenkins GitHub Plugin to version 1.29.2 or later to mitigate the vulnerability.
Template by ProjectDiscovery nuclei-templates (geeknik), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is CVE-2018-1000600 in your dependencies?
Find it across Maven, including transitive dependencies.