CVE-2022-20620

CVE-2022-20620 affects Jenkins SSH Agent Plugin (versions 1.23 and earlier). The root cause is missing permission checks in several HTTP endpoints, allowing attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. This could facilitate credential exposure ...

CVE-2018-1999036

CVE-2018-1999036 affects Jenkins SSH Agent Plugin 1.15 and earlier, where SSHAgentStepExecution.java logs the ssh-add command, exposing the SSH private key password to users who can read the build log. The issue’s root cause is sensitive information disclosure via build-log logging. Remediation i...