Jenkins Security Advisory 2025-07-09: Multiple Plugins Credential Exposure and Info Disclosure

Key Information Vulnerability Description Jenkins Security Advisory 2025-07-09 - Describes multiple security vulnerabilities present in various plugins, including improper credential handling, file path information disclosure, lack of input validation, and insecure storage of API keys and tokens. Vulnerability Details Credential Binding Plugin - Incorrect credential masking. HTML Publisher Plugin - File path information disclosure. Git Parameter Plugin - Parameter values lack input validation. Aqua Security Scanner Plugin - Tokens stored in plaintext. Statistics Gathering Plugin - AWS Secret Key stored unencrypted and displayed in plaintext. ReadyAPI Functional Testing Plugin - Credentials stored and displayed in plaintext. Applitools Eyes Plugin - Stored XSS vulnerability. QMetric Test Management Plugin - API keys stored and displayed in plaintext. Testigma Test Plan run Plugin - API keys displayed without masking. IFTTT Build Notifier Plugin - Keys stored in plaintext. IBM Cloud DevOps Plugin - Tokens stored in plaintext. Apice Loadtest Plugin - Tokens stored and displayed in plaintext. Dead Man's Snitch Plugin - Tokens stored and displayed in plaintext. Maddy Plugin - APIs and keys stored and displayed in plaintext. Novoza OneCloud Plugin - Keys stored and displayed in plaintext. Kryptonite Plugin - API keys stored in plaintext. SentryApi Plugin - Tokens stored and displayed in plaintext. Warrior Framework Plugin - Passwords stored in plaintext. Zoon Plugin - Tokens stored and displayed in plaintext. Userlist Ufacist Plugin - Tokens stored in plaintext. Affected Versions Lists specific plugin versions impacted by these vulnerabilities. Mitigation Measures Provides recommendations and steps to fix these vulnerabilities. Acknowledgments Thanks the security researchers who discovered and reported these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory 2025-07-09: Multiple Plugins Credential Exposure and Info Disclosure