GitHub Advisoryadvisory · Maven

GHSA-9v8g-f9mq-739g Improper masking of credentials in Jenkins Pipeline Maven Integration Plugin

MEDIUM Published 2023-09-06 Modified 2024-01-30 Official page ↗
Aliases
CVE-2023-41934
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:pipeline-maven
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-532
Reviewed
2024-01-30

Affected packages

• Maven org.jenkins-ci.plugins:pipeline-maven: < 1331.v003efa_fd6e81 → fixed in 1331.v003efa_fd6e81

Description

Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked.

Related

Alias · CVE (1)

  • CVE-2023-41934 Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References