Launch Week Day 1: Announcing Security Design Review
MEDIUM 4.3 Maven

Jenkins Pipeline: Groovy Plugin has Insufficiently Protected Credentials

GHSA-qv6q-x9vr-w7j3 · CVE-2022-25180

Published · Modified

Description

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds.

This allows attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.

Pipeline: Groovy Plugin 2656.vf7a_e7b_75a_457 does not allow builds containing password parameters to be replayed.

Ready to move

Start Securing

Free, no credit card | First findings in minutes