Insufficiently Protected Credentials in Jenkins AWS CodeBuild Plugin

ÉLEVÉE 7.8CVE-2018-1000404 · GHSA-mwg7-69hf-vqh3 · Published 09/07/2018 · updated 17/06/2026

En bref

CVE-2018-1000404 est une vulnérabilité ÉLEVÉE (CVSS 7.8) touchant com.amazonaws:aws-codebuild, aws codebuild (jenkins).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.34%, plus élevée que 27.5% des vulnérabilités.
Correctif : mettre à jour vers 0.27 ou plus récent.

Package	Affected versions	Patched versions
com.amazonaws:aws-codebuild Maven	`< 0.27`	`0.27`
aws codebuild jenkins	`≤ 0.26`	No fix yet

Description

Jenkins project Jenkins AWS CodeBuild Plugin version 0.26 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSClientFactory.java, CodeBuilder.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 0.27 and later.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-1000404 · ADVISORY
jenkinsci/aws-codebuild-plugin commit f5bae39 · WEB
jenkins.io/security/advisory/2018-06-25 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.amazonaws:aws-codebuild

Maven

< 0.27

0.27

aws codebuild

jenkins

≤ 0.26

No fix yet

Description

NVD description