CVE-2018-1000601

2018-06-2617:29:00

Google

osv.dev

0.001 Low

EPSS

Percentile

28.4%

JSON

A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.

CPENameOperatorVersion
ssh-credentials-plugineqssh-credentials-1.3
ssh-credentials-plugineqssh-credentials-0.1
ssh-credentials-plugineqssh-credentials-1.9
ssh-credentials-plugineqssh-credentials-1.13
ssh-credentials-plugineqssh-credentials-0.4
ssh-credentials-plugineqssh-credentials-1.11
ssh-credentials-plugineqssh-credentials-1.10
ssh-credentials-plugineqssh-credentials-1.2
ssh-credentials-plugineqssh-credentials-1.8
ssh-credentials-plugineqssh-credentials-1.12

Name	Operator	Version
ssh-credentials-plugin	eq	ssh-credentials-1.3
ssh-credentials-plugin	eq	ssh-credentials-0.1
ssh-credentials-plugin	eq	ssh-credentials-1.9
ssh-credentials-plugin	eq	ssh-credentials-1.13
ssh-credentials-plugin	eq	ssh-credentials-0.4
ssh-credentials-plugin	eq	ssh-credentials-1.11
ssh-credentials-plugin	eq	ssh-credentials-1.10
ssh-credentials-plugin	eq	ssh-credentials-1.2
ssh-credentials-plugin	eq	ssh-credentials-1.8
ssh-credentials-plugin	eq	ssh-credentials-1.12