GHSA-fjrv-vx9m-4jpj

ghsaUSosv

Veracode Scan Jenkins Plugin vulnerable to information disclosure

view advisory published 2023-03-28Licence: CC-BY-4.0

Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remote agent jobs, invokes the Veracode Java API Wrapper in a manner that allows local users (with OS-level access of the Jenkins remote) to discover Veracode API credentials by listing the process and its arguments.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-25722US	medium5.5	0.21% (11th)	—	2023-03-28
A credential-leak issue was discovered in related Veracode products before 2023-03-27. Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remote agent jobs, invokes…

references

External citations — patches, advisories, analysis.

https://community.veracode.com/s/global-search/CVE-2023-25722WEB
https://docs.veracode.com/updates/r/c_all_int#veracode-jenkins-plugin-233190WEB
https://github.com/jenkinsci/veracode-scan-pluginPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2023-25722ADVISORY
https://veracode.comWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan