Read the docs
TI-2013-05331 Aliases CVE-2013-6372GHSA-c4fr-gx5w-8qf2

The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding…

Priority LOW 12CWE-255Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-326.

Summary

The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.

Why it matters now

EPSS 0.00497 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.jenkins-ci.plugins:subversion (Maven): 1.54Red Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.jenkins-ci.plugins:subversion (Maven)before 1.541.54Patch availableGHSA-c4fr-gx5w-8qf2
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:subversion (Maven) Vendor— Affected before 1.54 Fixed in 1.54 Patch available GHSA-c4fr-gx5w-8qf2

CPE configurations NVD · 54

CPEVersionsRoleVendor
cpe:2.3:a:jenkins-ci:subversion-plugin:*:*:*:*:*:*:*:*up to 1.53VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.0:*:*:*:*:*:*:*1.0VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.1:*:*:*:*:*:*:*1.1VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.2:*:*:*:*:*:*:*1.2VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.3:*:*:*:*:*:*:*1.3VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.4:*:*:*:*:*:*:*1.4VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.5:*:*:*:*:*:*:*1.5VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.6:*:*:*:*:*:*:*1.6VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.7:*:*:*:*:*:*:*1.7VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.8:*:*:*:*:*:*:*1.8VulnerableJenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:*:*:*:*:*:*:*:* Versions up to 1.53 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.8:*:*:*:*:*:*:* Versions 1.8 Vulnerable ·Jenkins-ci
Show 44 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:jenkins-ci:subversion-plugin:1.9:*:*:*:*:*:*:*1.9VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.10:*:*:*:*:*:*:*1.10VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.11:*:*:*:*:*:*:*1.11VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.12:*:*:*:*:*:*:*1.12VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.13:*:*:*:*:*:*:*1.13VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.14:*:*:*:*:*:*:*1.14VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.15:*:*:*:*:*:*:*1.15VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.16:*:*:*:*:*:*:*1.16VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.17:*:*:*:*:*:*:*1.17VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.18:*:*:*:*:*:*:*1.18VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.19:*:*:*:*:*:*:*1.19VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.20:*:*:*:*:*:*:*1.20VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.21:*:*:*:*:*:*:*1.21VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.22:*:*:*:*:*:*:*1.22VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.23:*:*:*:*:*:*:*1.23VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.24:*:*:*:*:*:*:*1.24VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.25:*:*:*:*:*:*:*1.25VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.26:*:*:*:*:*:*:*1.26VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.27:*:*:*:*:*:*:*1.27VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.28:*:*:*:*:*:*:*1.28VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.29:*:*:*:*:*:*:*1.29VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.30:*:*:*:*:*:*:*1.30VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.31:*:*:*:*:*:*:*1.31VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.32:*:*:*:*:*:*:*1.32VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.33:*:*:*:*:*:*:*1.33VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.34:*:*:*:*:*:*:*1.34VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.35:*:*:*:*:*:*:*1.35VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.36:*:*:*:*:*:*:*1.36VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.37:*:*:*:*:*:*:*1.37VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.38:*:*:*:*:*:*:*1.38VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.39:*:*:*:*:*:*:*1.39VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.40:*:*:*:*:*:*:*1.40VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.41:*:*:*:*:*:*:*1.41VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.42:*:*:*:*:*:*:*1.42VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.43:*:*:*:*:*:*:*1.43VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.44:*:*:*:*:*:*:*1.44VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.45:*:*:*:*:*:*:*1.45VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.46:*:*:*:*:*:*:*1.46VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.47:*:*:*:*:*:*:*1.47VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.48:*:*:*:*:*:*:*1.48VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.49:*:*:*:*:*:*:*1.49VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.50:*:*:*:*:*:*:*1.50VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.51:*:*:*:*:*:*:*1.51VulnerableJenkins-ci
cpe:2.3:a:jenkins-ci:subversion-plugin:1.52:*:*:*:*:*:*:*1.52VulnerableJenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.10:*:*:*:*:*:*:* Versions 1.10 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.11:*:*:*:*:*:*:* Versions 1.11 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.12:*:*:*:*:*:*:* Versions 1.12 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.13:*:*:*:*:*:*:* Versions 1.13 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.14:*:*:*:*:*:*:* Versions 1.14 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.15:*:*:*:*:*:*:* Versions 1.15 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.16:*:*:*:*:*:*:* Versions 1.16 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.17:*:*:*:*:*:*:* Versions 1.17 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.18:*:*:*:*:*:*:* Versions 1.18 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.19:*:*:*:*:*:*:* Versions 1.19 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.20:*:*:*:*:*:*:* Versions 1.20 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.21:*:*:*:*:*:*:* Versions 1.21 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.22:*:*:*:*:*:*:* Versions 1.22 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.23:*:*:*:*:*:*:* Versions 1.23 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.24:*:*:*:*:*:*:* Versions 1.24 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.25:*:*:*:*:*:*:* Versions 1.25 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.26:*:*:*:*:*:*:* Versions 1.26 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.27:*:*:*:*:*:*:* Versions 1.27 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.28:*:*:*:*:*:*:* Versions 1.28 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.29:*:*:*:*:*:*:* Versions 1.29 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.30:*:*:*:*:*:*:* Versions 1.30 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.31:*:*:*:*:*:*:* Versions 1.31 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.32:*:*:*:*:*:*:* Versions 1.32 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.33:*:*:*:*:*:*:* Versions 1.33 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.34:*:*:*:*:*:*:* Versions 1.34 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.35:*:*:*:*:*:*:* Versions 1.35 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.36:*:*:*:*:*:*:* Versions 1.36 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.37:*:*:*:*:*:*:* Versions 1.37 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.38:*:*:*:*:*:*:* Versions 1.38 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.39:*:*:*:*:*:*:* Versions 1.39 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.40:*:*:*:*:*:*:* Versions 1.40 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.41:*:*:*:*:*:*:* Versions 1.41 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.42:*:*:*:*:*:*:* Versions 1.42 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.43:*:*:*:*:*:*:* Versions 1.43 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.44:*:*:*:*:*:*:* Versions 1.44 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.45:*:*:*:*:*:*:* Versions 1.45 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.46:*:*:*:*:*:*:* Versions 1.46 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.47:*:*:*:*:*:*:* Versions 1.47 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.48:*:*:*:*:*:*:* Versions 1.48 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.49:*:*:*:*:*:*:* Versions 1.49 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.50:*:*:*:*:*:*:* Versions 1.50 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.51:*:*:*:*:*:*:* Versions 1.51 Vulnerable ·Jenkins-ci
  • cpe:2.3:a:jenkins-ci:subversion-plugin:1.52:*:*:*:*:*:*:* Versions 1.52 Vulnerable ·Jenkins-ci

Remediation

  • Fix · GHSA-c4fr-gx5w-8qf2 org.jenkins-ci.plugins:subversion (Maven) Fixed in 1.54 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Enterprise 1AffectedNo fix planned: Will not fix
RHOSE Node 2.1Fixed—

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-6372
  2. 2026-10-03 Alias added: GHSA-c4fr-gx5w-8qf2

References

Exploit 1

Advisory 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences