GCVE - cpe:2.3:a:jenkins:credentials:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:credentials:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Credentials (`e6b54961-5aa5-5323-854b-13c4bd87fd1b`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/jenkinsci/credentials-plugin`	purl2cpe	2026-06-01 10:14:16.332595

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-47805`	vulnerable	2026-06-08 06:48:13.279085	Details available Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI. Published: 2024-10-02T15:35:03.653Z Updated: 2025-03-14T15:02:44.176Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-29036`	vulnerable	2026-06-08 05:42:46.344269	Details available Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Published: 2022-04-12T00:00:00.000Z Updated: 2024-08-03T06:10:58.182Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21648`	vulnerable	2026-06-08 05:29:13.077561	Details available Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability. Published: 2021-05-11T14:15:20.000Z Updated: 2024-08-03T18:16:23.936Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2349	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-10320`	vulnerable	2026-06-08 05:12:23.161130	Details available Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate. Published: 2019-05-21T13:00:22.000Z Updated: 2024-08-04T22:17:20.390Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2019/05/21/1 http://seclists.org/fulldisclosure/2019/May/39 http://www.securityfocus.com/bid/108462 https://wwws.nightwatchcybersecurity.com/2019/05/23/exploring-the-file-system-via-jenkins-credentials-plugin-vulnerability-cve-2019-10320/ https://access.redhat.com/errata/RHBA-2019:1605	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.