CVE-2022-38663

Опубликовано: 23 авг. 2022

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password (gitUsernamePassword) credentials binding.

Ссылки

http://www.openwall.com/lists/oss-security/2022/08/23/2
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2022-08-23/#SECURITY-2796
Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/08/23/2
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2022-08-23/#SECURITY-2796
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:git:*:*:*:*:*:jenkins:*:*

Версия до 4.11.4 (включая)

EPSS

Процентиль: 84%

0.02223

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-522

Связанные уязвимости

CVE-2022-38663

CVSS3: 4.3

redhat

больше 3 лет назад

Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.

GHSA-jxmw-3gxf-fprh