GitHub Advisoryadvisory · Maven

GHSA-rwh3-5g7v-3c5m Password written to the build log by Jenkins SQLPlus Script Runner Plugin

MEDIUM Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2020-2312
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:sqlplus-script-runner
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-522
Reviewed
2022-12-22

Affected packages

• Maven org.jenkins-ci.plugins:sqlplus-script-runner: < 2.0.13 → fixed in 2.0.13

Description

Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier prints the `sqlplus` command invocation to the build logs. This log message does not redact a password provided as part of a command line argument. This password can be viewed by users with Item/Read permission. Jenkins SQLPlus Script Runner Plugin 2.0.13 no longer prints the password in the build logs.

Related

Alias · CVE (1)

  • CVE-2020-2312 Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs. vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References