Insufficiently protected credentials in Jenkins ECS Publisher Plugin
Priority LOW 32CWE-522Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-522.
Summary
A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenkins home directory to obtain the API token configured in this plugin's configuration.
Why it matters now
EPSS 0.01584 75th percentileScored 2026-11-07
Fix Fixed de.eacg:ecs-publisher (Maven): 1.0.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Jenkins | Jenkins ECS Publisher Plugin | up to 1.0.0 | — | No fix listed | CNA |
| — | de.eacg:ecs-publisher (Maven) | before 1.0.1 | 1.0.1 | Patch available | GHSA-ffj8-w4rj-vr7v |
- Jenkins ECS Publisher Plugin VendorJenkins Affected up to 1.0.0 Fixed in — No fix listed CNA
- de.eacg:ecs-publisher (Maven) Vendor— Affected before 1.0.1 Fixed in 1.0.1 Patch available GHSA-ffj8-w4rj-vr7v
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:trustsource:ecs_publisher:*:*:*:*:*:jenkins:*:* | up to 1.0.0 | Vulnerable | Trustsource |
- cpe:2.3:a:trustsource:ecs_publisher:*:*:*:*:*:jenkins:*:* Versions up to 1.0.0 Vulnerable ·Trustsource
Remediation
- Fix · GHSA-ffj8-w4rj-vr7v de.eacg:ecs-publisher (Maven) Fixed in 1.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-1003045
- 2026-10-03 Alias added: GHSA-ffj8-w4rj-vr7v
References
More Jenkins vulnerabilities
- TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
- TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2019-1003045 · CVE Program
- CVE-2019-1003045 · NVD
- FIRST EPSS
- GHSA-ffj8-w4rj-vr7v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences