GCVE - cpe:2.3:a:jenkins:credentials_binding:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:credentials_binding:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Credentials Binding (`dd6c133e-ec43-5548-a5f9-02c83873f9c3`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-42520`	vulnerable	2026-06-08 08:03:16.454500	Details available Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node. Published: 2026-04-29T13:31:29.921Z Updated: 2026-04-29T14:02:37.784Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3672	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-53650`	vulnerable	2026-06-08 07:31:14.858474	Details available Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error messages that are written to the build log. Published: 2025-07-09T15:39:26.473Z Updated: 2025-11-04T21:11:52.810Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3499	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-20616`	vulnerable	2026-06-08 05:39:52.686724	Details available Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file. Published: 2022-01-12T19:05:51.000Z Updated: 2024-08-03T02:17:52.979Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2342 http://www.openwall.com/lists/oss-security/2022/01/12/6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-2182`	vulnerable	2026-06-08 05:24:59.051452	Details available Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances. Published: 2020-05-06T12:45:23.000Z Updated: 2024-08-04T07:01:40.977Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1835 http://www.openwall.com/lists/oss-security/2020/05/06/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-2181`	vulnerable	2026-06-08 05:24:59.050908	Details available Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps. Published: 2020-05-06T12:45:22.000Z Updated: 2024-08-04T07:01:40.930Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1374 http://www.openwall.com/lists/oss-security/2020/05/06/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-1000057`	vulnerable	2026-06-08 05:10:25.374012	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.