GitHub Advisoryadvisory · Maven

GHSA-fjrv-vx9m-4jpj Veracode Scan Jenkins Plugin vulnerable to information disclosure

MEDIUM Published 2023-03-28 Modified 2023-04-05 Official page ↗
Aliases
CVE-2023-25722
Ecosystem
Maven
Packages
com.veracode.jenkins:veracode-scan
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-214
Reviewed
2023-04-05

Affected packages

• Maven com.veracode.jenkins:veracode-scan: < 23.3.19.0 → fixed in 23.3.19.0

Description

Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remote agent jobs, invokes the Veracode Java API Wrapper in a manner that allows local users (with OS-level access of the Jenkins remote) to discover Veracode API credentials by listing the process and its arguments.

Related

Alias · CVE (1)

  • CVE-2023-25722 A credential-leak issue was discovered in related Veracode products before 2023-03-27. vulnerability

Weakness · CWE (1)

  • CWE-214 Invocation of Process Using Visible Sensitive Information weakness

References