Storing Passwords in a Recoverable Format

Overview org.jenkins-ci.plugins:credentials-binding is a plugin that allows credentials to be bound to environment variables for use from miscellaneous build steps. Affected versions of this package are vulnerable to Storing Passwords in a Recoverable Format via the config-variables.jelly file,...

com.amazon.jenkins.fleet:ec2-fleet (>=1.0, <=1.17.3), com.cloudbees.jenkins.plugins:amazon-ecr (1.6) +48 more potentially affected by CVE-2019-1010241 via org.jenkins-ci.plugins:credentials-binding (>=1.7, <=1.16)

org.jenkins-ci.plugins:credentials-binding MAVEN version =1.7, =1.0, =1.4, =0.17, =1.0.43, =1.0.0-b13, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.2.0-beta-1 and more Source cves: CVE-2019-1010241 Source advisory: SNYK:JAVA-ORGJENKINSCIPLUGINS-9402853...

GHSA-J7GW-MWFG-VQF4 Jenkins Credentials Binding Plugin Stores Passwords in a Recoverable Format

Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line 30 passwordVariable. The attack vector is: Attacker creates and executes a...

Jenkins Credentials Binding Plugin Stores Passwords in a Recoverable Format

Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line 30 passwordVariable. The attack vector is: Attacker creates and executes a...

org.jenkins-ci.plugins:credentials-binding (>=1.3, <=1.5), org.jenkins-ci.plugins:git (>=2.2.11, <=2.3.4) +2 more potentially affected by CVE-2019-10320 via org.jenkins-ci.plugins:credentials (1.20)

org.jenkins-ci.plugins:credentials MAVEN version 1.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:credentials-binding =1.3, =2.2.11, =0.0.1-beta7, =0.0.1-beta12 -...

com.cloudbees.jenkins.plugins:cloudbees-registration (3.15), io.jenkins.blueocean:blueocean-pipeline-editor (>=1.0-alpha-3, <=1.0-alpha-4) +3 more potentially affected by CVE-2019-10320 via org.jenkins-ci.plugins:credentials (1.23)

org.jenkins-ci.plugins:credentials MAVEN version 1.23 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - com.cloudbees.jenkins.plugins:cloudbees-registration 3.15 -...

org.jenkins-ci.plugins:credentials-binding (1.0) potentially affected by CVE-2019-10320 via org.jenkins-ci.plugins:credentials (1.13)

org.jenkins-ci.plugins:credentials MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:credentials-binding 1.0 Source cves: CVE-2019-10320 Source advisory:...

org.jenkins-ci.plugins:credentials-binding (1.0-beta-1), org.jenkins-ci.plugins:plain-credentials (>=1.0-beta-1, <=1.0) potentially affected by CVE-2019-10320 via org.jenkins-ci.plugins:credentials (1.8.2)

org.jenkins-ci.plugins:credentials MAVEN version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:credentials-binding 1.0-beta-1 -...

CVE-2022-20616

A missing permissions validation vulnerability was found in the Jenkins Credentials Binding plugin. The form validation method does not perform a permission check which allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it’s a z...

GHSA-GQM2-2GCX-P88W Incorrect Permission Assignment for Critical Resource in Jenkins Credentials Binding Plugin

Jenkins Credentials Binding Plugin prior to 1.27.1 and 1.24.1 does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it’s a zip file. Credentials...

CVE-2022-20616

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file...

CVE-2022-20616

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file...

CVE-2022-20616

CVE-2022-20616 refers to the Jenkins Credentials Binding Plugin (version ≤ 1.27) where a missing permission check in the form-validation method allows users with Overall/Read access to determine whether a given credential ID points to a secret file credential and whether it is a ZIP file. The des...

CVE-2022-20616

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file...

CVE-2022-20616

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file...

Jenkins 插件 权限许可和访问控制问题漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.The Jenkins Credentials Binding Plugin is vulnerable to an input validation error that stems from the plugin's failure to...

PT-2022-14825 · Jenkins · Jenkins Credentials Binding Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Credentials Binding Plugin versions 1.27 and earlier Jenkins Credentials Binding Plugin versions prior to 1.27.1 Jenkins Credentials Binding Plugin versions prior to 1.24.1 Description: The issue allows attackers with Overall/Read...

CVE-2022-20616: Missing Authorization

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file...

Missing permission check in credentials-binding allows validating secret file credentials IDs

credentials-binding 1.27 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file. credentials-binding 1.27.1 performs...

jenkins-credentials-binding-plugin: improper masking of secrets

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask i.e., replace with asterisks secrets containing a $ character in some circumstances...