CVE-2018-1000057 | BDVDB-2026-96347 Detail

Description#

Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided password values, e.g. replacing environment variable references, which could result in values different from but similar to configured passwords being provided to the build. Those values are not subject to masking, and could allow unauthorized users to recover the original password.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12018-02-09Record published in the CVE List.
2. Version 22024-08-05Most recent update recorded in the CVE List.