{"cve":"CVE-2017-1000387","nvd":{"published":"2018-01-26T02:29:00.330","modified":"2026-06-17T00:59:04.863","status":"Modified","description":"Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to access them. Additionally, the credentials were also transmitted in plain text as part of the configuration form. This could result in exposure of the credentials through browser extensions, cross-site scripting vulnerabilities, and similar situations.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-522"],"references":["http://www.securityfocus.com/bid/101544","https://jenkins.io/security/advisory/2017-10-23/","http://www.securityfocus.com/bid/101544","https://jenkins.io/security/advisory/2017-10-23/"],"products":["jenkins:build-publisher"],"source":"nvd","synced_at":"2026-10-19T20:48:34.567387330+00:00"},"epss":{"cve":"CVE-2017-1000387","score":0.00375,"percentile":0.31446,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-m3wv-fr8v-fmh7","url":"https://osv.dev/vulnerability/GHSA-m3wv-fr8v-fmh7","summary":"Jenkins Build-Publisher plugin has Insufficiently Protected Credentials","modified":"2024-02-17T05:32:32.795820Z","packages":[{"ecosystem":"Maven","name":"org.jenkins-ci.plugins:build-publisher","purl":"pkg:maven/org.jenkins-ci.plugins/build-publisher","ranges":["<1.22"],"fixed":["1.22"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}