GitHub Advisoryadvisory · Maven
GHSA-43j2-r4v3-m8jp Secrets are not masked by Jenkins Credentials Binding Plugin in builds without build steps
MEDIUM
Official page ↗
- Aliases
- CVE-2020-2181
- Ecosystem
- Maven
- Packages
- org.jenkins-ci.plugins:credentials-binding
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-522
- Reviewed
- 2022-06-24
Affected packages
• Maven org.jenkins-ci.plugins:credentials-binding: < 1.23 → fixed in 1.23
Description
Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps.
Jenkins Credentials Binding Plugin 1.23 now masks secrets when the build contains no build steps.
Related
Alias · CVE (1)
- CVE-2020-2181 Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build… vulnerability
Weakness · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-2181 advisory
- https://github.com/jenkinsci/credentials-binding-plugin/commit/59ead11bcb3fd132258d1d7da4a34d47750f40d2 web
- https://github.com/jenkinsci/credentials-binding-plugin package
- https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1374 web
- http://www.openwall.com/lists/oss-security/2020/05/06/3 web