{"id":"CVE-2018-1999028","aliases":["GHSA-8vg7-gh73-866v"],"url":"https://o3.security/vulnerability/CVE-2018-1999028","summary":"Jenkins Accurev Plugin CSRF vulnerability and missing permission checks","details":"An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.","published":"2018-08-01T13:29:00.513Z","modified":"2026-07-08T18:17:48.773844Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.jenkins-ci.plugins:accurev","fixedVersion":"0.7.17"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1021"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T18:17:48.773844Z"}}