Jenkins Job Configuration History Plugin
Monthly
Unauthorized configuration overwrite in Jenkins Job Configuration History Plugin (≤1367.vc8fa_b_15101dc) permits any authenticated low-privilege user to redirect the plugin's audit history storage to an attacker-specified filesystem directory and alter history recording settings via unsanitized Stapler data binding. By controlling the storage path, an attacker can corrupt or suppress configuration change audit trails, or potentially access sensitive directory contents at the redirected path. No public exploit code exists and EPSS stands at 0.15% (4th percentile), indicating low real-world exploitation pressure at this time.
Jenkins Job Configuration History Plugin version 1356.ve360da_6c523a_ and earlier exposes encrypted secret values to any Jenkins user holding Extended Read permission by failing to apply Jenkins' standard secret redaction when rendering historical job and agent configurations. Encrypted credential values that Jenkins would normally mask are displayed in full within the plugin's history view, potentially enabling offline analysis of those values. No public exploit or active exploitation has been identified; SSVC rates this as non-automatable with partial technical impact.
Unauthorized configuration overwrite in Jenkins Job Configuration History Plugin (≤1367.vc8fa_b_15101dc) permits any authenticated low-privilege user to redirect the plugin's audit history storage to an attacker-specified filesystem directory and alter history recording settings via unsanitized Stapler data binding. By controlling the storage path, an attacker can corrupt or suppress configuration change audit trails, or potentially access sensitive directory contents at the redirected path. No public exploit code exists and EPSS stands at 0.15% (4th percentile), indicating low real-world exploitation pressure at this time.
Jenkins Job Configuration History Plugin version 1356.ve360da_6c523a_ and earlier exposes encrypted secret values to any Jenkins user holding Extended Read permission by failing to apply Jenkins' standard secret redaction when rendering historical job and agent configurations. Encrypted credential values that Jenkins would normally mask are displayed in full within the plugin's history view, potentially enabling offline analysis of those values. No public exploit or active exploitation has been identified; SSVC rates this as non-automatable with partial technical impact.