7.8high
CVE-2018-1000404
Insufficiently Protected Credentials in Jenkins AWS CodeBuild Plugin
Also known as GHSA-mwg7-69hf-vqh3
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 27%
Public exploits
0
none known
Summary
Jenkins project Jenkins AWS CodeBuild Plugin version 0.26 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSClientFactory.java, CodeBuilder.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 0.27 and later.
Exploit prediction (EPSS)
0.34% probability of exploitation in the next 30 days, higher than 27% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.amazonaws:aws-codebuild | <0.27 | 0.27 |
Classification
- Weakness
- CWE-522 Insufficiently Protected Credentials
References
- jenkins.io /security/advisory/2018-06-25/#SECURITY-834 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-1000404 · advisory
- github.com /jenkinsci/aws-codebuild-plugin/commit/f5bae399c245ff6a7131ce9cca9636f5971d582c · web
Sources
- CVE List: CVE-2018-1000404
- GitHub Advisory: GHSA-mwg7-69hf-vqh3
- NVD: CVE-2018-1000404
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.