CVE-2018-1000601
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins SSH Credentials Plugin
A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.
- Record
CVE-2018-1000601- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.
- Record
CVE-2018-1000601- Updated
- 2026-11-02
EUVDEUVD-2022-3646 No score
A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.
- Record
EUVD-2022-3646- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cwcf-5m5w-mq2w
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins SSH Credentials Plugin
A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.
- Record
GHSA-cwcf-5m5w-mq2w- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.
- Record
CVE-2018-1000601- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-cwcf-5m5w-mq2w
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins SSH Credentials Plugin
A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.
- Record
GHSA-cwcf-5m5w-mq2w- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:ssh-credentialsMaven |
through 1.13 | 1.14 |
org.jenkins-ci.plugins:credentialsMaven |
before 2.1.17 | 2.1.17 |
org.jenkins-ci.plugins:ssh-credentialsMaven |
before 1.14, plus listed versions 0.10.20.30.41.0 Show 16 moreShow less1.11.101.111.121.131.21.31.41.51.5.11.61.6.11.71.7.11.81.9 |
1.14 |
org.jenkins-ci.plugins:credentialsMaven |
before 2.1.17, plus listed versions 1.01.11.101.111.12 Show 45 moreShow less1.131.141.151.161.16.11.171.181.191.21.201.211.221.231.241.251.261.271.281.31.3.11.41.51.61.71.7.11.7.21.7.31.7.41.7.51.7.61.81.8.11.8.21.8.31.8.41.91.9.11.9.21.9.31.9.42.02.0.12.0.22.0.32.0.4 |
2.1.17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000601 is a medium vulnerability (CVSS 6.5) in Jenkins Ssh Credentials, published June 26, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.01%, the 63rd percentile. Fixed in org.jenkins-ci.plugins:ssh-credentials 1.14.
References
jenkins.io/security/advisory/2018-06-25
nvd.nist.gov/vuln/detail/CVE-2018-1000601
github.com/jenkinsci/ssh-credentials-plugin/commit/18b3121fa94a174064447d637dc11539e33b3a76
Left out here: 20 versions. The JSON record has them.