Jenkins 17 Plugins Vulnerability: Plaintext Storage of Credentials and Secrets

Critical Vulnerability Information Vulnerability Description Aqua Security Scanner Plugin: Tokens stored in plaintext. Statistics Gathering Plugin: AWS keys stored and displayed in plaintext. ReadyAPI Functional Testing Plugin: Credentials stored and displayed in plaintext. Applitools Eyes Plugin: Stored XSS vulnerability. QMetric Test Management Plugin: API keys stored and displayed in plaintext. Testigma Test Plan run Plugin: API keys displayed without masking. IFTTT Build Notifier Plugin: Keys stored in plaintext. IBM Cloud DevOps Plugin: Tokens stored and displayed in plaintext. Spice Loadtest Plugin: Tokens stored and displayed in plaintext. Dead Man's Snitch Plugin: Tokens stored and displayed in plaintext. Maddy Plugin: API keys and secrets stored and displayed in plaintext. Novoza OneCloud Plugin: Keys stored and displayed in plaintext. Kryptonite Plugin: API keys stored in plaintext. Sentry.io Api Plugin: Tokens stored and displayed in plaintext. Warrior Framework Plugin: Passwords stored in plaintext. Xoon Plugin: Tokens stored and displayed in plaintext. Userlist Ufacast Plugin: Tokens stored in plaintext. Severity Critical: Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReadyAPI Functional Testing Plugin, Applitools Eyes Plugin, QMetric Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spice Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza OneCloud Plugin, Kryptonite Plugin, Sentry.io Api Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacast Plugin. Affected Versions Jenkins: Version 2.303.1 and earlier. Files Details specific files and code lines affected by the vulnerabilities. Acknowledgments Lists researchers who discovered and reported these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins 17 Plugins Vulnerability: Plaintext Storage of Credentials and Secrets