Jenkins Security Advisory 2025-07-09: Multiple Plugins Credential Exposure and Info Disclosure

Key Information Vulnerability Description Jenkins Security Advisory 2025-07-09 - Describes multiple security vulnerabilities present in various plugins, including improper credential handling, file path information disclosure, missing input validation, and insecure storage and display of API keys and tokens. Vulnerability Details Credential Binding Plugin - Incorrect credential binding. HTML Publisher Plugin - File path information disclosure. Git Parameter Plugin - Missing input validation for parameter values. Aqua Security Scanner Plugin - Tokens stored in plain text. Statistics Gathering Plugin - AWS Secret Key stored and displayed in plain text. ReadyAPI Functional Testing Plugin - Credentials stored and displayed in plain text. Applitools Eyes Plugin - Stored XSS vulnerability. Qmetry Test Management Plugin - API keys stored and displayed in plain text. Testigma Test Plan run Plugin - API keys not masked in display. IFTTT Build Notifier Plugin - Keys stored in plain text. IBM Cloud DevOps Plugin - Tokens stored in plain text. Apice Loadtest Plugin - Tokens stored and displayed in plain text. Dead Man's Snitch Plugin - Tokens stored and displayed in plain text. Windy Plugin - API Auth keys stored and displayed in plain text. Novoza DexCloud Plugin - Keys stored and displayed in plain text. Kryptonite Plugin - API keys stored in plain text. Sentry.io Api Plugin - Tokens stored and displayed in plain text. Warrior Framework Plugin - Passwords stored in plain text. Xoon Plugin - Tokens stored and displayed in plain text. Userlist Ufacial Plugin - Tokens stored in plain text. Severity Critical: Jenkins Pipeline Steps, Credentials Binding Plugin, HTML Publisher Plugin, Git Parameter Plugin, Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReadyAPI Functional Testing Plugin, Applitools Eyes Plugin, Qmetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Apice Loadtest Plugin, Dead Man's Snitch Plugin, Windy Plugin, Novoza DexCloud Plugin, Kryptonite Plugin, Sentry.io Api Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacial Plugin. Affected Versions Lists specific plugin versions affected by the vulnerabilities. Mitigation Provides remediation guidance and recommended updated versions for each vulnerability. Acknowledgments Thanks to the security researchers who discovered and reported these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory 2025-07-09: Multiple Plugins Credential Exposure and Info Disclosure