PT-2022-24513 · Jenkins · Jenkins Git Plugin+1

Peter Darton + 1 · Published 2022-08-23 · Updated 2023-11-02 · CVE-2022-38663

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Git Plugin versions 4.11.4 and earlier

Description The issue concerns the improper masking of credentials in the build log. Specifically, the Git Username and Password (gitUsernamePassword) credentials binding does not properly replace credentials with asterisks. This could potentially expose sensitive information.

Recommendations For Jenkins Git Plugin versions 4.11.4 and earlier, update to a version that properly masks credentials in the build log. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-38663

GHSA-JXMW-3GXF-FPRH

Affected Products

Jenkins

Jenkins Git Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2022-38663 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-08-23/#SECURITY-2796 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38663 · Security Note
• https://osv.dev/vulnerability/GHSA-jxmw-3gxf-fprh · Vendor Advisory
• https://github.com/jenkinsci/git-plugin · Note
• https://github.com/jenkinsci/git-plugin/commit/3241db9cc696711c871d4e78b3c3c0daad0740c3 · Note
• http://openwall.com/lists/oss-security/2022/08/23/2 · Note
• https://t.me/cibsecurity/48611 · Telegram Post