GHSA-fjrv-vx9m-4jpj

Veracode Scan Jenkins Plugin vulnerable to information disclosure

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-25722

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.veracode.jenkins:veracode-scan	< 23.3.19.0	23.3.19.0

Details

As written in the advisory (Markdown source, shown as plain text).

Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remote agent jobs, invokes the Veracode Java API Wrapper in a manner that allows local users (with OS-level access of the Jenkins remote) to discover Veracode API credentials by listing the process and its arguments.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-25722 advisory
https://community.veracode.com/s/global-search/CVE-2023-25722 web
https://docs.veracode.com/updates/r/c_all_int#veracode-jenkins-plugin-233190 web
https://github.com/jenkinsci/veracode-scan-plugin package
https://veracode.com web