A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.jenkins-ci.plugins:ssh-credentials(Maven) | 0 | 1.14 | N/A |
| org.jenkins-ci.plugins:credentials(Maven) | 0 | 2.1.17 | N/A |
CVSS Metrics
