What is GHSA-fjrv-vx9m-4jpj?

GHSA-fjrv-vx9m-4jpj is a security advisory published by GitHub Security Advisories with Medium severity. Veracode Scan Jenkins Plugin vulnerable to information disclosure

Which CVE IDs does GHSA-fjrv-vx9m-4jpj cover?

GHSA-fjrv-vx9m-4jpj covers the following CVE IDs: CVE-2023-25722. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fjrv-vx9m-4jpj?

GHSA-fjrv-vx9m-4jpj has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

Which products are affected by GHSA-fjrv-vx9m-4jpj?

GHSA-fjrv-vx9m-4jpj affects 1 product, including: maven/com.veracode.jenkins:veracode-scan:\u003c 23.3.19.0.

GHSA-fjrv-vx9m-4jpjMediumCVSS 5.5

Veracode Scan Jenkins Plugin vulnerable to information disclosure

Vendor

GitHub Security Advisories

Published

March 28, 2023

Last Modified

April 5, 2023

🔗 CVE IDs covered (1)

CVE-2023-25722 →

📋 Description

Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remote agent jobs, invokes the Veracode Java API Wrapper in a manner that allows local users (with OS-level access of the Jenkins remote) to discover Veracode API credentials by listing the process and its arguments.

🎯 Affected products1

maven/com.veracode.jenkins:veracode-scan:< 23.3.19.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-25722
https://docs.veracode.com/updates/r/c_all_int#veracode-jenkins-plugin-233190
https://veracode.com
https://community.veracode.com/s/global-search/CVE-2023-25722
https://github.com/advisories/GHSA-fjrv-vx9m-4jpj