Security readout for executives and security teams
Plain-English summary
Older Jenkins Subversion plugin versions stored repository credentials with base64 encoding, not effective secret protection. A local user who could read the credentials file could recover passwords or SSH private keys, potentially exposing source code and deployment paths.
Executive priority
Treat this as a legacy credential exposure issue. Prioritize affected Jenkins systems because recovered SCM credentials can expose source code, build secrets, and release workflows.
Technical view
CVE-2013-6372 affects Jenkins Subversion plugin versions before 1.54. The plugin stored credentials in a subversion.credentials file using base64 encoding, allowing local users with file read access to obtain passwords and SSH private keys.
Likely exposure
Exposure is most likely on legacy Jenkins installations using the Subversion plugin before 1.54, especially where multiple local users or services can read Jenkins files or backups.
Exploitation context
The source bundle identifies local file access as the required condition. It does not provide evidence of internet-scale exploitation, public weaponization, or CISA KEV listing.
Researcher notes
Evidence is limited but consistent: the vulnerability is credential disclosure through reversible storage. The bundle does not include CVSS, CWE, affected CPEs, exploit activity, or detailed vendor remediation beyond the before-1.54 version boundary.
Mitigation direction
- Upgrade the Jenkins Subversion plugin to version 1.54 or later.
- Restrict local access to Jenkins home and credential-related files.
- Rotate Subversion passwords and SSH keys if the vulnerable file may have been readable.
- Check Jenkins advisory guidance before making broader operational changes.
Validation and detection
- Inventory Jenkins instances using the Subversion plugin.
- Confirm the installed Subversion plugin version is 1.54 or later.
- Check whether subversion.credentials exists on legacy Jenkins systems or backups.
- Review local file permissions around Jenkins home and credential storage.
- Look for unusual repository access using affected credentials.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2013-6372 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-11-20CVE reference · x_refsource_CONFIRM
- https://bugzilla.redhat.com/show_bug.cgi?id=1032391CVE reference · x_refsource_MISC
- https://github.com/jenkinsci/subversion-plugin/commit/7d4562d6f7e40de04bbe29577b51c79f07d05ba6CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.