medium6.5
CVE-2022-25187
Jenkins Support Core Plugin stores sensitive data in plain text
Impact
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle. Support Core Plugin 2.79.1 adds a list of keywords whose associated values are redacted.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:support-core | < 2.79.1 | 2.79.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Support Core | through 2.79 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2186
- https://github.com/advisories/GHSA-5m8f-v3gw-h94w
- https://nvd.nist.gov/vuln/detail/CVE-2022-25187
- https://github.com/jenkinsci/support-core-plugin/commit/c6d20da4f372f03bd3e4844f0df2f109df68a63c
- https://github.com/jenkinsci/support-core-plugin/commit/e90487a87bc0a3445c887203f5badec17af905c5