Description

Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Connect using proxy" option is enabled and configured with proxy credentials and when the Jenkins global system setting debug is enabled and when a scan is configured for remote agent jobs, allows users (with access to view the job log) to discover proxy credentials.

Remediation

References

https://veracode.com

https://docs.veracode.com/updates/r/c_all_int#veracode-jenkins-plugin-233190

Related Vulnerabilities

CVE-2022-29037 Vulnerability in maven package org.jenkins-ci.plugins:cvs

CVE-2021-32014 Vulnerability in npm package xlsx

CVE-2018-20677 Vulnerability in maven package org.webjars.bowergithub.angular-ui:bootstrap

CVE-2014-3679 Vulnerability in maven package org.jvnet.hudson.plugins:monitoring

CVE-2019-5448 Vulnerability in npm package yarn

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory Release Notes NVD-CWE-noinfo