PT-2023-20273 · Veracode · Veracode Scan Jenkins Plugin

Published 2023-03-28 · Updated 2023-04-05 · CVE-2023-25721

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Veracode Scan Jenkins Plugin versions prior to 23.3.19.0

Description The issue allows users with access to view the job log to discover proxy credentials under specific configurations. This includes when the "Connect using proxy" option is enabled, configured with proxy credentials, and the Jenkins global system setting debug is enabled, along with a scan configured for remote agent jobs. By default, only the job owner or Jenkins admin can view the job log.

Recommendations For versions prior to 23.3.19.0, update to version 23.3.19.0 or later to resolve the issue. As a temporary workaround, consider disabling the "Connect using proxy" option or restricting access to job logs to minimize the risk of exploitation. Additionally, disabling the debug setting in Jenkins global system settings can also mitigate the risk.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2023-25721

GHSA-C4JR-VJM4-27HQ

Affected Products

Veracode Scan Jenkins Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-25721 · Security Note
• https://veracode.com · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c4jr-vjm4-27hq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25721 · Vendor Advisory
• https://github.com/jenkinsci/veracode-scan-plugin · Note
• https://t.me/cvenotify/47562 · Telegram Post
• https://community.veracode.com/s/spotlight/frequently-asked-questions-for-cve-2023-25721-and-cve-2023-25722-MCFT34TH6OGRFR7F7JGDQQP4TNZE · Note
• https://docs.veracode.com/updates/r/c_all_int#veracode-jenkins-plugin-233190 · Note