Jenkins Security Advisory: Multiple Plugins Vulnerabilities (Credential Exposure, Input Validation)

Key Information Vulnerability Description Jenkins Security Advisory 2025-07-09 - Describes multiple security vulnerabilities present in various plugins, including improper credential handling, file path information disclosure, lack of input validation, and plaintext storage of API keys and tokens. Vulnerability Details Credential Binding Plugin - Improper credential binding. HTML Publisher Plugin - File path information disclosure. Git Parameter Plugin - Parameter values lack input validation. Aqua Security Scanner Plugin - Token stored in plaintext. Statistics Gathering Plugin - AWS Secret Key stored and displayed in plaintext. ReadyAPI Functional Testing Plugin - Credentials stored and displayed in plaintext. Applitools Eyes Plugin - Stored XSS vulnerability. Qmetry Test Management Plugin - API key stored and displayed in plaintext. Testigma Test Plan run Plugin - API key not masked in display. IFTTT Build Notifier Plugin - Key stored in plaintext. IBM Cloud DevOps Plugin - Token stored in plaintext. Spice Loadtest Plugin - Token stored and displayed in plaintext. Dead Man's Snitch Plugin - Token stored and displayed in plaintext. Maddy Plugin - API Auth key stored and displayed in plaintext. Novoza DexCloud Plugin - Key stored and displayed in plaintext. Kryptonite Plugin - API key stored in plaintext. Sentry.io Api Plugin - Token stored and displayed in plaintext. Warrior Framework Plugin - Password stored in plaintext. Xoon Plugin - Token stored and displayed in plaintext. Userist Discourse Plugin - Token stored in plaintext. Severity Critical: Jenkins Pipeline Steps, Credentials Binding Plugin, HTML Publisher Plugin, Git Parameter Plugin, Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReadyAPI Functional Testing Plugin, Applitools Eyes Plugin, Qmetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spice Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza DexCloud Plugin, Kryptonite Plugin, Sentry.io Api Plugin, Warrior Framework Plugin, Xoon Plugin, Userist Discourse Plugin. Affected Versions Lists specific plugin versions affected by the vulnerabilities. Mitigation Provides remediation recommendations and updated versions for each vulnerability. Acknowledgments Thanks to the security researchers who discovered and reported these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: Multiple Plugins Vulnerabilities (Credential Exposure, Input Validation)