Lucene search

GitHub Advisory DatabaseGHSA-PVJF-4HFG-WR84

HistoryJul 26, 2023 - 3:30 p.m.

Incorrect control flow in Jenkins Gradle Plugin breaks credentials masking in the build log

2023-07-2615:30:57

CWE-670

GitHub Advisory Database

github.com

jenkins

gradle

plugin

control flow

credentials

build log

security

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

JSON

Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.

Affected configurations

Vulners

Node

org.jenkinsci.plugins\Matchgradle

CPENameOperatorVersion
org.jenkins-ci.plugins:gradlele2.8

CPE	Name	Operator	Version
	org.jenkins-ci.plugins:gradle	le	2.8

References

www.openwall.com/lists/oss-security/2023/07/26/2

github.com/advisories/GHSA-pvjf-4hfg-wr84

nvd.nist.gov/vuln/detail/CVE-2023-39152

www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3208

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

JSON

Related for GHSA-PVJF-4HFG-WR84