Medium severity5.5NVD Advisory· Published Aug 1, 2018· Updated Jun 17, 2026

CVE-2018-1999041

Description

An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attackers with file system access to the Jenkins master to obtain the API secret key stored in this plugin's configuration.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.tinfoilsecurity.plugins:tinfoil-scanMaven	< 2.0	2.0

Affected products

ghsa-coords
pkg:maven/com.tinfoilsecurity.plugins/tinfoil-scan
Range: < 2.0
Jenkins Project/Tinfoil Security
cpe:2.3:a:jenkins:tinfoil_security:*:*:*:*:*:jenkins:*:*
Range: <=1.6.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-68qx-whxm-h4c4ghsaADVISORY
jenkins.io/security/advisory/2018-07-30/nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2018-1999041ghsaADVISORY
github.com/jenkinsci/tinfoil-scan-plugin/commit/26b39449fd75213973a509accde5b3938dbd1f91ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000