CVE-2017-1000387 Jenkins Build-Publisher plugin has Insufficiently Protected Credentials

What is CVE-2017-1000387?

CVE-2017-1000387 is a high-severity vulnerability in n/a, published on 26 Jan 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to access them. Additionally, the credentials were also transmitted in plain text as part of the configuration form. This could result in exposure of the credentials through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Weakness: CWE-522

Which versions are affected by CVE-2017-1000387?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:build-publisher. It affects 1 product.

Products include Jenkins Build-Publisher.

How do I fix CVE-2017-1000387?

Upgrade org.jenkins-ci.plugins:build-publisher to 1.22 or later.

Is CVE-2017-1000387 being exploited?

There is no known exploitation of CVE-2017-1000387 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-41232 Jenkins build-publisher plugin vulnerable to cross-site request forgery High 8.0
• CVE-2022-41231 Path traversal in Jenkins build-publisher Plugin Medium 5.7
• CVE-2022-41230 Missing permission check in Jenkins build-publisher Plugin Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m3wv-fr8v-fmh7.