Jenkins Security Advisory: Multiple Plugin Vulnerabilities (Credential Leakage/Plaintext Storage)

Key Information Vulnerability Description Jenkins Security Advisory 2025-07-09 - Describes multiple security vulnerabilities present in various plugins, including improper credential handling, leakage of file path information, lack of input validation, and plaintext storage and display of API keys and tokens. Vulnerability Details Credential Binding Plugin - Incorrect credential masking may lead to exposure of sensitive information. HTML Publisher Plugin - File path information is leaked within HTML output. Git Parameter Plugin - Parameter values lack input validation. Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReadyAPI Functional Testing Plugin, Applitools Eyes Plugin, QMetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spica Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza DexCloud Plugin, Kryptonite Plugin, Sentredis Api Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacast Plugin - Each exhibits issues related to plaintext storage and display of API keys, tokens, or credentials. Severity Critical: Jenkins CLI Plugin, Credentials Binding Plugin, HTML Publisher Plugin, Git Parameter Plugin, Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReadyAPI Functional Testing Plugin, Applitools Eyes Plugin, QMetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spica Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza DexCloud Plugin, Kryptonite Plugin, Sentredis Api Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacast Plugin High: Jenkins CLI Plugin, Credentials Binding Plugin, HTML Publisher Plugin, Git Parameter Plugin, Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReadyAPI Functional Testing Plugin, Applitools Eyes Plugin, QMetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spica Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza DexCloud Plugin, Kryptonite Plugin, Sentredis Api Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacast Plugin Medium: Jenkins CLI Plugin, Credentials Binding Plugin, HTML Publisher Plugin, Git Parameter Plugin, Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReadyAPI Functional Testing Plugin, Applitools Eyes Plugin, QMetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spica Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza DexCloud Plugin, Kryptonite Plugin, Sentredis Api Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacast Plugin Low: Jenkins CLI Plugin, Credentials Binding Plugin, HTML Publisher Plugin, Git Parameter Plugin, Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReadyAPI Functional Testing Plugin, Applitools Eyes Plugin, QMetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spica Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza DexCloud Plugin, Kryptonite Plugin, Sentredis Api Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacast Plugin Affected Versions Lists specific plugin versions impacted by the vulnerabilities. Mitigation Provides remediation guidance and recommended updated versions for each vulnerability. Acknowledgments Thanks to the security researchers who discovered and reported these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: Multiple Plugin Vulnerabilities (Credential Leakage/Plaintext Storage)