Jenkins Build-Publisher plugin has Insufficiently Protected Credentials

published 2018-01-26 8 y ago modified 2026-06-17 4 mo ago also GHSA-m3wv-fr8v-fmh7 , EUVD-2022-4482

cvss: 7.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits: 0; none known

Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to access them. Additionally, the credentials were also transmitted in plain text as part of the configuration form. This could result in exposure of the credentials through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Patch / fix

fixed in 1

maven org.jenkins-ci.plugins:build-publisher 1.22

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N
GitHub	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.jenkins-ci.plugins:build-publisher	<1.22	1.22

Classification

Weakness

CWE-522 Insufficiently Protected Credentials

References

jenkins.io /security/advisory/2017-10-23/
vendor-advisory
securityfocus.com /bid/101544
vdb-entry, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2017-1000387
advisory
jenkins.io /security/advisory/2017-10-23
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary