High severity7.8NVD Advisory· Published Jul 9, 2018· Updated Jun 17, 2026

CVE-2018-1000404

Description

Jenkins project Jenkins AWS CodeBuild Plugin version 0.26 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSClientFactory.java, CodeBuilder.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 0.27 and later.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.amazonaws:aws-codebuildMaven	< 0.27	0.27

Affected products

ghsa-coords
pkg:maven/com.amazonaws/aws-codebuild
Range: < 0.27

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-mwg7-69hf-vqh3ghsaADVISORY
jenkins.io/security/advisory/2018-06-25/nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2018-1000404ghsaADVISORY
github.com/jenkinsci/aws-codebuild-plugin/commit/f5bae399c245ff6a7131ce9cca9636f5971d582cghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000