VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 17 hours ago

CVE-2013-6372

2.1 Low No exploit published

Description

The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.

CWE-255CWE-326

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited, which is not the same as ruling it out. nothing published in 12 years.

CVSS E:U

  • CISA KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 0.50% chance in 30 days

Waratek Defense Posture

No exploit published

In RASP's scope with an upstream fix path, but nobody has published a working exploit. That is a statement about what has been published, not a finding that the defect is unreachable or unimportant.

  • Protection none
  • Action unverified patch rule
  • Review automated upstream-data
  • Record active
Decided by below-action-threshold : Medium or Low severity, no KEV listing, no PoC clearing the evidence bar, no CISA verdict, no Oracle advisory
Finding This CVE is LOW severity, is not listed in CISA KEV, has no public exploit or PoC in any indexed source, carries no CISA Vulnrichment finding of a demonstrated exploit, and is not part of an Oracle Critical Patch Update. None of the signals that would put it in front of an engineer is present, and the volume of CVEs below that bar is too great to take one at a time, so no rule is written for it. This is a decision about what we act on, not a finding that the CVE is harmless — a patch may well be derivable, and a low-severity defect can still be one link in a longer chain.
Candidate fix https://github.com/jenkinsci/subversion-plugin/commit/7d4562d6f7e40de04bbe29577b51c79f07d05ba6 : a commit: the change itself

CVSS

2.1 v2.0 AV:L/AC:L/Au:N/C:P/I:N/A:N 1 metric

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 2.0 2.1 no band published AV:L/AC:L/Au:N/C:P/I:N/A:N NVD Primary published

Affected Software & Releases

☕ Maven Library Packages

Artifact coordinates and fix boundaries from OSV.dev
Package CoordinateIntroducedFixedLast affected
org.jenkins-ci.plugins:subversion 0 1.54 unbounded

🖥️ Product CPEs & Version Ranges

2 product(s) over 55 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd jenkins-ci subversion-plugin generic 1.0 · 1.1 · 1.2 · 1.3 · 1.4 · 1.5 · 1.6 · 1.7 · 1.8 · 1.9 · 1.10 · 1.11 · 1.12 · 1.13 · 1.14 · 1.15 · 1.16 · 1.17 · 1.18 · 1.19 · 1.20 · 1.21 · 1.22 · 1.23 · 1.24 · 1.25 · 1.26 · 1.27 · 1.28 · 1.29 · 1.30 · 1.31 · 1.32 · 1.33 · 1.34 · 1.35 · 1.36 · 1.37 · 1.38 · 1.39 · 1.40 · 1.41 · 1.42 · 1.43 · 1.44 · 1.45 · 1.46 · 1.47 · 1.48 · 1.49 · 1.50 · 1.51 · 1.52 · ≤ 1.53
osv org.jenkins-ci.plugins subversion generic ＜ 1.54

References

URLTags
https://github.com/jenkinsci/subversion-plugin/commit/7d4562d6f7e40de04bbe29577b51c79f07d05ba6 commit
https://access.redhat.com/errata/RHBA-2014:1630 WEB
https://access.redhat.com/security/cve/CVE-2013-6372 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=1032391 WEB
https://github.com/jenkinsci/subversion-plugin PACKAGE
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-11-20 WEB

Timeline

Published 2014-05-08 Last modified 2026-06-17
Published2014-05-08By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.