medium5.5
CVE-2023-25722
Veracode Scan Jenkins Plugin vulnerable to information disclosure
Impact
Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remote agent jobs, invokes the Veracode Java API Wrapper in a manner that allows local users (with OS-level access of the Jenkins remote) to discover Veracode API credentials by listing the process and its arguments.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.veracode.jenkins:veracode-scan | < 23.3.19.0 | 23.3.19.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Veracode | Veracode | before 23.3.19.0 |