{"cve":"CVE-2018-1000057","nvd":{"published":"2018-02-09T23:29:02.073","modified":"2026-06-17T01:32:20.027","status":"Modified","description":"Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided password values, e.g. replacing environment variable references, which could result in values different from but similar to configured passwords being provided to the build. Those values are not subject to masking, and could allow unauthorized users to recover the original password.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-522"],"references":["https://jenkins.io/security/advisory/2018-02-05/","https://jenkins.io/security/advisory/2018-02-05/"],"products":["jenkins:credentials_binding"],"source":"nvd","synced_at":"2026-10-19T20:48:34.567387330+00:00"},"epss":{"cve":"CVE-2018-1000057","score":0.00663,"percentile":0.51732,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-38xm-xhvj-q2qf","url":"https://osv.dev/vulnerability/GHSA-38xm-xhvj-q2qf","summary":"Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials","modified":"2024-02-21T05:23:38.933679Z","packages":[{"ecosystem":"Maven","name":"org.jenkins-ci.plugins:credentials-binding","purl":"pkg:maven/org.jenkins-ci.plugins/credentials-binding","ranges":["<1.15"],"fixed":["1.15"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}