Description
Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers able to create a credential with the same ID as a legitimate one in a different credentials store to sign an event published to RabbitMQ with the legitimate credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins Eiffel Broadcaster Plugin | 2.8.0 – ≤ 2.10.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.axis.jenkins.plugins.eiffel:eiffel-broadcaster | >= 2.8.0, < 2.10.3 | 2.10.3 | GHSA-fpw7-8gjc-jwqj |
Advisories 1
- WID-SEC-2025-0175 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 22, 2025
References
- Jenkins Security Advisory 2025-01-22 vendor-advisory