What is GHSA-9v8g-f9mq-739g?

GHSA-9v8g-f9mq-739g is a security advisory published by GitHub Security Advisories with Medium severity. Improper masking of credentials in Jenkins Pipeline Maven Integration Plugin

Which CVE IDs does GHSA-9v8g-f9mq-739g cover?

GHSA-9v8g-f9mq-739g covers the following CVE IDs: CVE-2023-41934. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9v8g-f9mq-739g?

GHSA-9v8g-f9mq-739g has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-9v8g-f9mq-739g?

GHSA-9v8g-f9mq-739g affects 1 product, including: maven/org.jenkins-ci.plugins:pipeline-maven:\u003c= 1330.v18e473854496.

GHSA-9v8g-f9mq-739gMediumCVSS 5.3

Improper masking of credentials in Jenkins Pipeline Maven Integration Plugin

Vendor

GitHub Security Advisories

Published

September 6, 2023

Last Modified

September 26, 2024

🔗 CVE IDs covered (1)

CVE-2023-41934 →

📋 Description

Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked.

🎯 Affected products1

maven/org.jenkins-ci.plugins:pipeline-maven:<= 1330.v18e473854496

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-41934
https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3257
http://www.openwall.com/lists/oss-security/2023/09/06/9
https://github.com/advisories/GHSA-9v8g-f9mq-739g