GHSA-mf4p-wjrm-cmjp
GitHub Security Advisory
AWS secrets displayed without masking by Jenkins S3 Explorer Plugin
✓ GitHub Reviewed
LOW
Has CVE
Advisory Details
S3 Explorer Plugin stores AWS_SECRET_ACCESS_KEY in its global configuration file `s3explorer.xml` on the Jenkins controller as part of its configuration.
While this secret is stored encrypted on disk, in S3 Explorer Plugin 1.0.8 and earlier the global configuration form does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture it.
Affected Packages
Maven
io.jenkins.plugins:s3explorer
Affected versions:
0
(last affected: 1.0.8)
Related CVEs
Key Information
2.5
/10
Dataset
Last updated: August 25, 2025 6:33 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.