GHSA-9v8g-f9mq-739g

ghsaUSosv

Improper masking of credentials in Jenkins Pipeline Maven Integration Plugin

view advisory published 2023-09-06Licence: CC-BY-4.0

Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-41934US	medium5.3	0.65% (50th)	—	2023-09-06
Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven se…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2023/09/06/9WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-41934ADVISORY
https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3257WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan