GitHub Advisoryadvisory · Maven

GHSA-c4fr-gx5w-8qf2 Jenkins Subversion Plugin Stores Credentials with Base64 Encoding

MEDIUM Published 2022-05-17 Modified 2025-03-13 Official page ↗
Aliases
CVE-2013-6372
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:subversion
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-326
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.plugins:subversion: < 1.54 → fixed in 1.54

Description

The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.

Related

Alias · CVE (1)

  • CVE-2013-6372 The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and… vulnerability

Weakness · CWE (1)

  • CWE-326 Inadequate Encryption Strength weakness

References