WaratekVRT Sign in

Jenkins Credentials CVEs

23 CVEs, 2 protected by Waratek

Reset
More filters (2)
Columns
Vendor jenkins✕Product credentials✕
Overview 23 matches · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 1 EPSS ≥ 0.5
23matches 2protected8.7% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 1EPSS ≥ 0.54.3%
Protected by Waratek 2 8.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 21 91.3%
Critical 0 0.0% High 7 30.4% Medium 16 69.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 8.7% partly blocked 0 0.0% not blocked 21 91.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 1 4.3% No public exploit 22 95.7%
split by peak 4 / year
No exploit published: 21Protected by Waratek: 2 Medium: 16High: 7 not blocked: 21blocked by ARMR today: 2 No public exploit: 22Forecast only: 1
20182 No exploit published2 Medium2 not blocked2 No public exploit2 20194 Protected by Waratek1 No exploit published3 High1 Medium3 blocked by ARMR today1 not blocked3 No public exploit4 20202 No exploit published2 Medium2 not blocked2 No public exploit2 20212 No exploit published2 Medium2 not blocked2 No public exploit2 20224 No exploit published4 High1 Medium3 not blocked4 Forecast only1 No public exploit3 20234 No exploit published4 High1 Medium3 not blocked4 No public exploit4 20242 No exploit published2 High1 Medium1 not blocked2 No public exploit2 20251 No exploit published1 High1 not blocked1 No public exploit1 20262 Protected by Waratek1 No exploit published1 High2 blocked by ARMR today1 not blocked1 No public exploit2
201820192020202120222023202420252026
23 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-48922 High 2026-05-27 Protected by Waratek No public exploit Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.
CVE-2026-42520 High 2026-04-29 No exploit published No public exploit Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.
CVE-2025-53650 High 2025-07-09 No exploit published No public exploit Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error messages that are written to the build log.
CVE-2024-47805 High 2024-10-02 No exploit published No public exploit Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.
CVE-2024-39459 Medium 2024-06-26 No exploit published No public exploit In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials).
CVE-2023-25768 Medium 2023-02-15 No exploit published No public exploit A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server.
CVE-2023-25767 High 2023-02-15 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-specified web server.
CVE-2023-25766 Medium 2023-02-15 No exploit published No public exploit A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2023-24425 Medium 2023-01-26 No exploit published No public exploit Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials they are not entitled to.
CVE-2022-29036 Medium 2022-04-12 No exploit published Forecast only Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-27199 Medium 2022-03-15 No exploit published No public exploit A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.
CVE-2022-27198 High 2022-03-15 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.
CVE-2022-20616 Medium 2022-01-12 No exploit published No public exploit Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file.
CVE-2021-21648 Medium 2021-05-11 No exploit published No public exploit Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVE-2021-21625 Medium 2021-03-18 No exploit published No public exploit Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circumstances.
CVE-2020-2182 Medium 2020-05-06 No exploit published No public exploit Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances.
CVE-2020-2181 Medium 2020-05-06 No exploit published No public exploit Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps.
CVE-2019-10436 Medium 2019-10-16 Protected by Waratek No public exploit An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master.
CVE-2019-1010241 Medium 2019-07-19 No exploit published No public exploit Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line #30 (passwordVariable). The attack vector is: Attacker creates and executes a Jenkins job.
CVE-2019-10320 Medium 2019-05-21 No exploit published No public exploit Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
CVE-2019-10303 High 2019-04-18 No exploit published No public exploit Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they could be viewed by users with access to the master file system.
CVE-2018-1000601 Medium 2018-06-26 No exploit published No public exploit A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.
CVE-2018-1000057 Medium 2018-02-09 No exploit published No public exploit Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided password values, e.g. replacing environment variable references, which could result in values different from but similar to configured passwords being provided to the build. Those values are not subject to masking, and could allow unauthorized users to recover the original password.