Lucene search

Veracode Vulnerability DatabaseVERACODE:45838

HistoryMar 12, 2024 - 5:47 a.m.

Information Disclosure

2024-03-1205:47:56

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

information disclosure

sony mobile

jenkins

build logs

sensitive data

software

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.2%

JSON

com.sonymobile.jenkins.plugins.mq, mq-notifier is vulnerable to Information Disclosure. The vulnerability is due to logging potentially sensitive build parameters as part of debug information in build logs by default, which could lead to the unintentional exposure of sensitive data.

CPENameOperatorVersion
mq notifierle1.4.0
mq notifierle1.4.0

CPE	Name	Operator	Version
	mq notifier	le	1.4.0
	mq notifier	le	1.4.0

References

www.openwall.com/lists/oss-security/2024/03/06/3

github.com/advisories/GHSA-8fm4-r23p-v68v

github.com/jenkinsci/mq-notifier-plugin/commit/46c9f228a3317eb87562bc3d99f7e184bdcecbfe

www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3180