GitHub Advisoryadvisory · Maven

GHSA-hr96-qfvm-52r6 Maven Integration Plugin did not mask sensitive values in module build logs

MEDIUM Published 2022-05-24 Modified 2023-12-14 Official page ↗
Aliases
CVE-2019-10358
Ecosystem
Maven
Packages
org.jenkins-ci.main:maven-plugin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2023-12-14

Affected packages

• Maven org.jenkins-ci.main:maven-plugin: < 3.4 → fixed in 3.4

Description

Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log.

Related

Alias · CVE (1)

  • CVE-2019-10358 Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References