CVE-2023-25721 Veracode Scan Jenkins Plugin vulnerable to information disclosure
Users with job log access can discover proxy credentials when specific debug and proxy settings are enabled in the Veracode Scan Jenkins Plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-25721?
CVE-2023-25721 is a medium-severity vulnerability in n/a, published on 28 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Connect using proxy" option is enabled and configured with proxy credentials and when the Jenkins global system setting debug is enabled and when a scan is configured for remote agent jobs, allows users (with access to view the job log) to discover proxy credentials.
Weakness: CWE-532
Which versions are affected by CVE-2023-25721?
2 open source packages ship an affected version, including com.veracode.jenkins:veracode-scan. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.veracode.jenkins:veracode-scan Maven | All versions | 23.3.19.0 |
com.veracode.jenkins:veracode-scan Maven | All versions | 23.3.19.0 |
Products include Veracode Veracode.
How do I fix CVE-2023-25721?
Upgrade com.veracode.jenkins:veracode-scan to 23.3.19.0 or later.
Is CVE-2023-25721 being exploited?
There is no known exploitation of CVE-2023-25721 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-c4jr-vjm4-27hq.