Exposure of sensitive information vulnerability in Jenkins Black Duck Hub Plugin

2022-05-1403:13:12

Google

osv.dev

jenkins

black duck hub plugin

vulnerability

sensitive information

postbuildscandescriptor.java

overall/read access

credentials ids

attacker-specified url

attacker-specified credentials

jenkins.

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.