Jenkins Security Advisory 2025-07-09: Multiple Plugins Credential Exposure and Info Disclosure

Key Information Vulnerability Description Jenkins Security Advisory 2025-07-09 - Describes multiple security vulnerabilities present in various plugins, including improper credential handling, leakage of file path information, lack of input validation, and insecure storage and display of API keys and tokens. Vulnerability Details Credential Binding Plugin - Incorrect credential masking. HTML Publisher Plugin - File path information leaked in HTML. Git Parameter Plugin - Parameter values lack input validation. Aqua Security Scanner Plugin - Tokens stored in plaintext. Statistics Gathering Plugin - AWS Secret Key stored and displayed in plaintext. ReadyAPI Functional Testing Plugin - Credentials stored and displayed in plaintext. Applitools Eyes Plugin - Stored XSS vulnerability. Qmetry Test Management Plugin - API keys stored and displayed in plaintext. Testigma Test Plan run Plugin - API keys displayed without masking. IFTTT Build Notifier Plugin - Keys stored in plaintext. IBM Cloud DevOps Plugin - Tokens stored in plaintext. Apice Loadtest Plugin - Tokens stored and displayed in plaintext. Dead Man's Snitch Plugin - Tokens stored in plaintext. Maddy Plugin - API Auth keys stored and displayed in plaintext. Novoza OneCloud Plugin - Keys stored and displayed in plaintext. Kryptonite Plugin - API keys stored in plaintext. Sentry.io Api Plugin - Tokens stored and displayed in plaintext. Warrior Framework Plugin - Passwords stored in plaintext. Xoon Plugin - Tokens stored and displayed in plaintext. Userlist Ufacial Plugin - Tokens stored in plaintext. Severity Critical: Jenkins Pipeline Steps, Credentials Binding Plugin, HTML Publisher Plugin, Git Parameter Plugin, Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReadyAPI Functional Testing Plugin, Applitools Eyes Plugin, Qmetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Apice Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza OneCloud Plugin, Kryptonite Plugin, Sentry.io Api Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacial Plugin. High: Jenkins Pipeline Steps, Credentials Binding Plugin, HTML Publisher Plugin, Git Parameter Plugin, Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReadyAPI Functional Testing Plugin, Applitools Eyes Plugin, Qmetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Apice Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza OneCloud Plugin, Kryptonite Plugin, Sentry.io Api Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacial Plugin. Affected Versions Lists specific plugin versions affected by the vulnerabilities. Mitigation Provides remediation guidance and recommended updated versions for each vulnerability. Acknowledgments Thanks to the security researchers who discovered and reported these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory 2025-07-09: Multiple Plugins Credential Exposure and Info Disclosure