Jenkins Security Advisory 2025-07-09: Multiple Plugins Credential Leakage and XSS

Key Information Vulnerability Description Jenkins Security Advisory 2025-07-09 - Describes multiple security vulnerabilities present in various plugins, including credential leakage, file path information disclosure, and missing input validation. Vulnerability Details Credential Binding Plugin - Incorrect credential masking. HTML Publisher Plugin - File path information disclosure. Git Parameter Plugin - Missing input validation for parameter values. Aqua Security Scanner Plugin - Tokens stored and displayed in plain text. Statistics Gathering Plugin - AWS Secret Key stored and displayed in plain text. ReadyAPI Functional Testing Plugin - Credentials stored and displayed in plain text. Applitools Eyes Plugin - Stored XSS vulnerability. Qmetry Test Management Plugin - API key stored and displayed in plain text. Testigma Test Plan run Plugin - API key not masked in display. IFTTT Build Notifier Plugin - Keys stored in plain text. IBM Cloud DevOps Plugin - Tokens stored and displayed in plain text. Spice Loadtest Plugin - Tokens stored and displayed in plain text. Dead Man's Snitch Plugin - Tokens stored and displayed in plain text. Maddy Plugin - API Auth key stored and displayed in plain text. Novoza DexCloud Plugin - Keys stored and displayed in plain text. Kryptonite Plugin - API key stored in plain text. SentryApi Plugin - Tokens stored and displayed in plain text. Warrior Framework Plugin - Passwords stored in plain text. Xoon Plugin - Tokens stored and displayed in plain text. Userlist Userfile Plugin - Tokens stored in plain text. Severity Critical: Jenkins Pipeline Steps, Credentials Binding Plugin, HTML Publisher Plugin, Git Parameter Plugin, Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReadyAPI Functional Testing Plugin, Applitools Eyes Plugin, Qmetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spice Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza DexCloud Plugin, Kryptonite Plugin, SentryApi Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Userfile Plugin. Affected Versions Lists specific plugin versions affected by the vulnerabilities. Mitigation Provides remediation recommendations and updated versions for each vulnerability. Acknowledgments Thanks to the security researchers who discovered and reported these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory 2025-07-09: Multiple Plugins Credential Leakage and XSS