Lucene search

MitreCVE-2023-25721

HistoryMar 28, 2023 - 8:15 p.m.

CVE-2023-25721

2023-03-2820:15:11

mitre

web.nvd.nist.gov

veracode

jenkins plugin

security

vulnerability

proxy credential disclosure

nvd

cve-2023-25721

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

27.5%

JSON

Veracode Scan Jenkins Plugin before 23.3.19.0, when the “Connect using proxy” option is enabled and configured with proxy credentials and when the Jenkins global system setting debug is enabled and when a scan is configured for remote agent jobs, allows users (with access to view the job log) to discover proxy credentials.

Affected configurations

Nvd

Node

veracodeveracodeRange<23.3.19.0jenkins

VendorProductVersionCPE
veracodeveracode*cpe:2.3:a:veracode:veracode:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
veracode	veracode	*	cpe:2.3:a:veracode:veracode::::::jenkins::*

References

docs.veracode.com/updates/r/c_all_int#veracode-jenkins-plugin-233190

veracode.com

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

27.5%

JSON

Related for CVE-2023-25721