description: Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file.
affected:
{
product: Jenkins Credentials Binding Plugin
vendor: Jenkins project
versions:
lessThanOrEqual: 1.27, status: affected, version: unspecified, versionType: custom
status: unaffected, version: 1.24.1
}