jenkinsci/veracode-scan-plugin · Security
Veracode Scan Jenkins Plugin vulnerable to information disclosure
- GHSA ID
- GHSA-fjrv-vx9m-4jpj
- CVE ID
- CVE-2023-25722
- Severity
- medium
- Published
- Updated
- CVSS
- 5.5 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 5.5 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remote agent jobs, invokes the Veracode Java API Wrapper in a manner that allows local users (with OS-level access of the Jenkins remote) to discover Veracode API credentials by listing the process and its arguments.
CWEs
- CWE-214 · Invocation of Process Using Visible Sensitive Information