Jenkins Statistics Gatherer Plugin AWS Secret Key Storage Vulnerability
Vulnerability
A vulnerability exists in the Jenkins Statistics Gatherer Plugin in versions through 2.0.3, where the AWS Secret Key is stored unencrypted in the global configuration file on the Jenkins controller. This key can be accessed by users with permission to read the Jenkins controller file system. Furthermore, the configuration form does not mask the key, increasing the risk of exposure.
Impact
The unencrypted AWS Secret Key can be viewed by users with access to the Jenkins controller file system.
Added: Jul 9, 2025, 5:13 PM
Updated: Jul 9, 2025, 5:13 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
2.5exploitability
5.2remediation
0.0relevance
0.2threat
0.0urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.