CVE-2013-6372
Jenkins Subversion Plugin Stores Credentials with Base64 Encoding
The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.
Exploit likelihood
What each source reports
NVD Score used
The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.
- Record
CVE-2013-6372- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE List No score
The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.
- Record
CVE-2013-6372- Updated
- 2026-11-02
EUVDEUVD-2013-6197 No score
The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.
- Record
EUVD-2013-6197- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c4fr-gx5w-8qf2
Jenkins Subversion Plugin Stores Credentials with Base64 Encoding
The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.
- Record
GHSA-c4fr-gx5w-8qf2- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-326
- Updated
- 2026-11-02
OSVGHSA-c4fr-gx5w-8qf2
Jenkins Subversion Plugin Stores Credentials with Base64 Encoding
The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.
- Record
GHSA-c4fr-gx5w-8qf2- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-326
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:subversionMaven |
before 1.54 | 1.54 |
org.jenkins-ci.plugins:subversionMaven |
before 1.54, plus listed versions 1.241.251.261.281.29 Show 20 moreShow less1.301.311.321.331.341.351.361.371.381.391.401.411.421.431.441.451.481.501.511.53 |
1.54 |
jenkinsRed Hat:openshift:2.0::el6 From an advisory covering 22 CVEs |
before 0:1.565.3-1.el6op | 0:1.565.3-1.el6op |
jenkins-plugin-openshiftRed Hat:openshift:2.0::el6 From an advisory covering 22 CVEs |
before 0:0.6.40.1-0.el6op | 0:0.6.40.1-0.el6op |
openshift-origin-cartridge-jenkinsRed Hat:openshift:2.0::el6 From an advisory covering 22 CVEs |
before 0:1.20.3.5-1.el6op | 0:1.20.3.5-1.el6op |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6372 is a low vulnerability (CVSS 2.1) in Jenkins-ci Subversion-plugin, published May 8, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 42nd percentile. Fixed in org.jenkins-ci.plugins:subversion 1.54.
References
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-11-20
bugzilla.redhat.com/show_bug.cgi?id=1032391
github.com/jenkinsci/subversion-plugin/commit/7d4562d6f7e40de04bbe29577b51c79f07d05ba6
nvd.nist.gov/vuln/detail/CVE-2013-6372
access.redhat.com/errata/RHBA-2014:1630
Show 89 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2014/rhba-2014_1630.json
cve.org/CVERecord?id=CVE-2013-5573