GitHub Advisoryadvisory · Maven

GHSA-c4jr-vjm4-27hq Veracode Scan Jenkins Plugin vulnerable to information disclosure

MEDIUM Published 2023-03-28 Modified 2023-04-05 Official page ↗
Aliases
CVE-2023-25721
Ecosystem
Maven
Packages
com.veracode.jenkins:veracode-scan
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2023-04-05

Affected packages

• Maven com.veracode.jenkins:veracode-scan: < 23.3.19.0 → fixed in 23.3.19.0

Description

Veracode Scan Jenkins Plugin before 23.3.19.0 is vulnerable to information disclosure of proxy credentials in job logs under specific configurations. Users are potentially affected if they: • are using Veracode Scan Jenkins Plugin prior to 23.3.19.0 • AND have configured Veracode Scan to run on remote agent jobs • AND have enabled the "Connect using proxy" option • AND have configured the proxy settings with proxy credentials • AND a Jenkins admin has enabled debug in global system settings. By default, even in this configuration only the job owner or Jenkins admin can view the job log.

Related

Alias · CVE (1)

  • CVE-2023-25721 Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Connect using proxy" option is enabled and configured with proxy credentials and… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References