CVE-2017-1000113

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or users with Extended Read access to the jobs it is used in, to retrieve those passwords. The Deploy to container Plugin now integrates with Credentials Plugin to store passwords securely, and automatically migrates existing passwords.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10001143.1The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypte CVE-2017-10001157.5Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the reposito CVE-2017-10001169.8Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.CVE-2017-10001178.8A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any prog CVE-2017-10001187.5Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service CVE-2017-10001197.2October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other a CVE-2017-10001208.8[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbit CVE-2017-10001219.8The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised CVE-2017-10001225.3The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromi CVE-2017-10001257.5Codiad(full version) is vulnerable to write anything to configure file in the installation resulting upload a webshell.CVE-2017-10001265.5exiv2 0.26 contains a Stack out of bounds read in webp parser CVE-2017-10001275.5Exiv2 0.26 contains a heap buffer overflow in tiff parser