GHSA-c4jr-vjm4-27hqMediumCVSS 4.4

Veracode Scan Jenkins Plugin vulnerable to information disclosure

Published
March 28, 2023
Last Modified
April 5, 2023

🔗 CVE IDs covered (1)

CVE-2023-25721 →

📋 Description

Veracode Scan Jenkins Plugin before 23.3.19.0 is vulnerable to information disclosure of proxy credentials in job logs under specific configurations.

Users are potentially affected if they:

  • are using Veracode Scan Jenkins Plugin prior to 23.3.19.0
  • AND have configured Veracode Scan to run on remote agent jobs
  • AND have enabled the "Connect using proxy" option
  • AND have configured the proxy settings with proxy credentials
  • AND a Jenkins admin has enabled debug in global system settings.

By default, even in this configuration only the job owner or Jenkins admin can view the job log.

🎯 Affected products1

  • maven/com.veracode.jenkins:veracode-scan:< 23.3.19.0

🔗 References (5)