Skip to content
OpenAdvisories
Medium · 6.5 CVE-2018-1000601 EUVD-2022-3646GHSA-cwcf-5m5w-mq2w

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins SSH Credentials Plugin

Published Jun 26, 2018 · Updated Sep 16, 2024 · Assigned by mitre

Package: org.jenkins-ci.plugins:credentials Package: org.jenkins-ci.plugins:ssh-credentials Ecosystem: Maven

Description

A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:credentials < 2.1.17 2.1.17 GHSA-cwcf-5m5w-mq2w
Maven org.jenkins-ci.plugins:ssh-credentials < 1.14 1.14 GHSA-cwcf-5m5w-mq2w

References