High severity7.8NVD Advisory· Published Jan 26, 2018· Updated Jun 17, 2026
CVE-2017-1000387
CVE-2017-1000387
Description
Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to access them. Additionally, the credentials were also transmitted in plain text as part of the configuration form. This could result in exposure of the credentials through browser extensions, cross-site scripting vulnerabilities, and similar situations.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:build-publisherMaven | < 1.22 | 1.22 |
Affected products
1Patches
Vulnerability mechanics
References
5- www.securityfocus.com/bid/101544nvdThird Party AdvisoryVDB EntryWEB
- github.com/advisories/GHSA-m3wv-fr8v-fmh7ghsaADVISORY
- jenkins.io/security/advisory/2017-10-23/nvdVendor Advisory
- nvd.nist.gov/vuln/detail/CVE-2017-1000387ghsaADVISORY
- jenkins.io/security/advisory/2017-10-23ghsaWEB
News mentions
0No linked articles in our index yet.