CVE-2022-25180: Insufficiently Protected Credentials

February 16, 2022 (updated August 15, 2022)

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.

References

github.com/advisories/GHSA-qv6q-x9vr-w7j3
nvd.nist.gov/vuln/detail/CVE-2022-25180
www.jenkins.io/security/advisory/2022-02-15/

Code Behaviors & Features

Detect and mitigate CVE-2022-25180 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →