CVE-2018-1000142
Jenkins GitHub Pull Request Builder Plugin allows attacker with local file system access to obtain GitHub credentials
An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials.
- Record
CVE-2018-1000142- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials.
- Record
CVE-2018-1000142- Updated
- 2026-11-02
EUVDEUVD-2022-4200 No score
An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials.
- Record
EUVD-2022-4200- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hr74-2j5v-ghfv
Jenkins GitHub Pull Request Builder Plugin allows attacker with local file system access to obtain GitHub credentials
An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials. Since 1.40.0, the plugin no longer stores serialized objects containing the credential on disk. Builds started before the plugin was updated to 1.40.0 will retain the encoded credentials on disk. We strongly recommend revoking old GitHub credentials used in Jenkins. We’re providing a script for use in the Script Console that will attempt to remove old stored credentials from build.xml files.
- Record
GHSA-hr74-2j5v-ghfv- CVSS 3.0
- 4.0 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials.
- Record
CVE-2018-1000142- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-hr74-2j5v-ghfv
Jenkins GitHub Pull Request Builder Plugin allows attacker with local file system access to obtain GitHub credentials
An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials. Since 1.40.0, the plugin no longer stores serialized objects containing the credential on disk. Builds started before the plugin was updated to 1.40.0 will retain the encoded credentials on disk. We strongly recommend revoking old GitHub credentials used in Jenkins. We’re providing a script for use in the Script Console that will attempt to remove old stored credentials from build.xml files.
- Record
GHSA-hr74-2j5v-ghfv- CVSS 3.0
- 4.0 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:ghprbMaven |
through 1.39.0 | 1.40.0 |
org.jenkins-ci.plugins:ghprbMaven |
before 1.40.0, plus listed versions 1.01.11.1.11.11.21.12 Show 45 moreShow less1.131.13-11.141.14-11.14-21.14-31.14-41.14-51.14-61.14-71.15-01.15-11.16-01.16-11.16-21.16-31.16-41.16-51.16-61.16-71.16-81.171.181.191.21.201.20.11.211.21.11.221.22.11.22.21.22.31.22.41.231.23.11.23.21.23.31.241.24.11.24.21.24.31.24.41.24.51.24.6 |
1.40.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000142 is a high vulnerability (CVSS 7.8) in Jenkins Github Pull Request Builder, published April 5, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in org.jenkins-ci.plugins:ghprb 1.40.0.
References
Left out here: 63 versions. The JSON record has them.