| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:credentials-binding | ≥ 1.25, < 1.27.1< 1.24.1 | 1.27.11.24.1 |
| credentials binding | ≤ 1.27 |
Jenkins Credentials Binding Plugin prior to 1.27.1 and 1.24.1 does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it’s a zip file.
Credentials Binding Plugin 1.27.1 and 1.24.1 performs permission checks when validating secret file credentials IDs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free