CVE-2018-1000057

CWE-522 — Insufficiently Protected CredentialsCWE-1177 documents7 sources
Severity
4.3MEDIUM
EPSS
0.0%
top 91.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Jenkins Credentials Binding
Timeline
PublishedFeb 9
Latest updateMay 13

Description

Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided password values, e.g. replacing environment variable references, which could result in values different from but similar to configured passwords being provided to the build. Those values are not subject to masking, and could allow unauthorized users to recover the original password.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

🔴Vulnerability Details

3
OSV
Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials↗2022-05-13
▶
GHSA
Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials↗2022-05-13
▶
CVEList
CVE-2018-1000057: Jenkins Credentials Binding Plugin 1↗2018-02-09
▶

📋Vendor Advisories

2
Jenkins
Jenkins Security Advisory 2018-02-05↗2018-02-05
▶
Red Hat
jenkins-plugin-credentials-binding: improper masking of the secret provided to the build in rare circumstances↗2018-02-05
▶

💬Community

1
Bugzilla
CVE-2018-1000057 jenkins-plugin-credentials-binding: improper masking of the secret provided to the build in rare circumstances↗2018-02-06
▶