Jenkins Security Advisory 2025-07-09: Credential Exposure and Input Validation Issues in Multiple Plugins

Key Information Vulnerability Description Jenkins Security Advisory 2025-07-09 - Describes multiple security vulnerabilities present in various plugins, including: - Credentials not properly masked in the Credentials Binding Plugin - File path information leakage in the HTML Publisher Plugin - Lack of input validation for parameter values in the Git Parameter Plugin - Tokens or keys stored and displayed without masking in the following plugins: Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReedyAPI Functional Testing Plugin, Applitools Eyes Plugin, Qmetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spice Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza OneCloud Plugin, Kryptonite Plugin, Sensedia Api Platform Plugin, Warrior Framework Plugin, Xoon Plugin, and Userlist Ufacial Plugin. Severity Critical: Jenkins Pipeline Steps API Plugin, Credentials Binding Plugin, HTML Publisher Plugin, Git Parameter Plugin, Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReedyAPI Functional Testing Plugin, Applitools Eyes Plugin, Qmetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spice Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza OneCloud Plugin, Kryptonite Plugin, Sensedia Api Platform Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacial Plugin High: Jenkins Pipeline Steps API Plugin, Credentials Binding Plugin, HTML Publisher Plugin, Git Parameter Plugin, Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReedyAPI Functional Testing Plugin, Applitools Eyes Plugin, Qmetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spice Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza OneCloud Plugin, Kryptonite Plugin, Sensedia Api Platform Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacial Plugin Medium: Jenkins Pipeline Steps API Plugin, Credentials Binding Plugin, HTML Publisher Plugin, Git Parameter Plugin, Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReedyAPI Functional Testing Plugin, Applitools Eyes Plugin, Qmetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spice Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza OneCloud Plugin, Kryptonite Plugin, Sensedia Api Platform Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacial Plugin Low: Jenkins Pipeline Steps API Plugin, Credentials Binding Plugin, HTML Publisher Plugin, Git Parameter Plugin, Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReedyAPI Functional Testing Plugin, Applitools Eyes Plugin, Qmetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spice Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza OneCloud Plugin, Kryptonite Plugin, Sensedia Api Platform Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacial Plugin Affected Versions Lists specific plugin versions affected, such as: - Jenkins Pipeline Steps API Plugin: 1.8 to 1.10 - Credentials Binding Plugin: 1.13 to 1.16 - HTML Publisher Plugin: 1.19 to 1.22 - Git Parameter Plugin: 0.9.13 to 0.9.16 - Aqua Security Scanner Plugin: 1.0.0 to 1.0.3 - Statistics Gathering Plugin: 0.14 to 0.17 - ReedyAPI Functional Testing Plugin: 1.0.0 to 1.0.3 - Applitools Eyes Plugin: 3.10.0 to 3.13.0 - Qmetry Test Management Plugin: 3.1.0 to 3.1.3 - Testigma Test Plan run Plugin: 1.0.0 to 1.0.3 - IFTTT Build Notifier Plugin: 1.0.0 to 1.0.3 - IBM Cloud DevOps Plugin: 1.0.0 to 1.0.3 - Spice Loadtest Plugin: 1.0.0 to 1.0.3 - Dead Man's Snitch Plugin: 1.0.0 to 1.0.3 - Maddy Plugin: 1.0.0 to 1.0.3 - Novoza OneCloud Plugin: 1.0.0 to 1.0.3 - Kryptonite Plugin: 1.0.0 to 1.0.3 - Sensedia Api Platform Plugin: 1.0.0 to 1.0.3 - Warrior Framework Plugin: 1.0.0 to 1.0.3 - Xoon Plugin: 1.0.0 to 1.0.3 - Userlist Ufacial Plugin: 1.0.0 to 1.0.3 Mitigation Measures Provides remediation recommendations and updated versions for each vulnerability. ``` This information helps users identify which plugins are at risk and how to resolve these issues by updating to the latest versions.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory 2025-07-09: Credential Exposure and Input Validation Issues in Multiple Plugins