{"id":"CVE-2018-1999028","aliases":["GHSA-8vg7-gh73-866v"],"url":"https://o3.security/vulnerability/CVE-2018-1999028","summary":"Jenkins Accurev Plugin CSRF vulnerability and missing permission checks","details":"An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.","published":"2018-08-01T13:29:00.513Z","modified":"2026-07-08T18:17:48.773844Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.jenkins-ci.plugins:accurev","fixedVersion":"0.7.17"}],"fix":{"url":"https://github.com/jenkinsci/accurev-plugin/commit/a86e05f7747b8f7d483f61a840cfb7a1a0105eee","label":"jenkinsci/accurev-plugin@a86e05f"},"references":[{"type":"ADVISORY","url":"https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1021"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1999028"},{"type":"WEB","url":"https://github.com/jenkinsci/accurev-plugin/commit/a86e05f7747b8f7d483f61a840cfb7a1a0105eee"},{"type":"PACKAGE","url":"https://github.com/jenkinsci/accurev-plugin"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T18:17:48.773844Z"}}