jenkinsci/pipeline-build-step-plugin · Security
Password parameter default values exposed by Jenkins Pipeline: Build Step Plugin
- GHSA ID
- GHSA-g84f-cmc8-682c
- CVE ID
- CVE-2022-25184
- Severity
- medium
- Published
- Updated
- CVSS
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs.
CWEs
- CWE-522 · Insufficiently Protected Credentials