Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.jenkins-ci.plugins:aws-credentials

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.3MavenPublished

    Missing permission checks in Jenkins CloudBees AWS Credentials Plugin allows enumerating credentials IDs

    CVE-2021-21625 · GHSA-jwr9-h4jm-c9ch

    Affected
    • Maven org.jenkins-ci.plugins:aws-credentials <= 1.28
    Fixed in
    1.28.1· Vendor fix available
    Issue
    CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins if any of the following plugins are installed: - Amazon Elastic Container Service (ECS) / Fargate - AWS Parameter Store Build Wrapper - AWS SAM\n\nFurther plugins may use this helper method as well without performing a permission check themselves. Credentials IDs obtained this way can be used as part of an attack to capture the credentials using another vulnerability. CloudBees AWS Credentials Plugin 1.28.1 performs permission checks in the helper method for HTTP endpoints.

    Recommended action: Upgrade to 1.28.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 4.3MavenPublished

    Missing permission checks in AWS Credentials Plugin

    CVE-2022-27199 · GHSA-m9gv-4523-jffm

    Affected
    • Maven org.jenkins-ci.plugins:aws-credentials <= 189.v3551d5642995
    Fixed in
    191.vcb_f183ce58b_9· Vendor fix available
    Issue
    A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.

    Recommended action: Upgrade to 191.vcb_f183ce58b_9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →