Description

Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

Remediation

References

https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3077

Related Vulnerabilities

CVE-2019-10461 Vulnerability in maven package org.jenkins-ci.plugins:dynatrace-dashboard

CVE-2014-2063 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2021-21623 Vulnerability in maven package org.jenkins-ci.plugins:matrix-auth

CVE-2023-48219 Vulnerability in npm package tinymce

CVE-2010-4207 Vulnerability in npm package yui

Severity

High

Classification

CWE-532 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory