Project Inheritance Plugin showed secret environment variables defined in Mask Passwords Plugin

2022-05-2422:00:44

Google

osv.dev

jenkins

security

environment variables

sensitive data

software vulnerability

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

Jenkins Project Inheritance Plugin 19.08.02 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin.

References

www.openwall.com/lists/oss-security/2019/09/25/3

jenkins.io/security/advisory/2019-09-25/#SECURITY-351

nvd.nist.gov/vuln/detail/CVE-2019-10407