GHSA-9v8g-f9mq-739g

Suggest an improvement
Source
https://github.com/advisories/GHSA-9v8g-f9mq-739g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-9v8g-f9mq-739g/GHSA-9v8g-f9mq-739g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9v8g-f9mq-739g
Aliases
Published
2023-09-06T15:30:26Z
Modified
2024-09-26T22:22:47.525623Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Improper masking of credentials in Jenkins Pipeline Maven Integration Plugin
Details

Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked.

Database specific 
{
    "nvd_published_at": "2023-09-06T13:15:10Z",
    "cwe_ids": [
        "CWE-532"
    ],
    "github_reviewed_at": "2024-01-30T23:11:07Z",
    "severity": "MODERATE",
    "github_reviewed": true
}
References

Affected packages

Maven / org.jenkins-ci.plugins:pipeline-maven

Package

Name
org.jenkins-ci.plugins:pipeline-maven
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/pipeline-maven

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1331.v003efa_fd6e81

Affected versions

0.*
0.1-beta
0.2
0.3
0.4
0.5
0.6
0.7
2.*
2.0-beta-3
2.0-beta-4
2.0-beta-5
2.0-beta-6
2.0-beta-7
2.0
2.0.1
2.0.2
2.0.3
2.1.0-beta-1
2.1.0
2.1.1-beta-1
2.2.0
2.2.1
2.3.0-beta-1
2.3.0
2.3.1-beta-1
2.3.1
2.4.0-beta-1
2.4.0-beta-2
2.4.0
2.5.0-alpha-1
2.5.0
2.5.1
2.5.2
3.*
3.0.0-beta-1
3.0.0-beta-2
3.0.0-beta-3
3.0.0-beta-4
3.0.0-beta-5
3.0.0-beta-6
3.0.0
3.0.1-beta-1
3.0.1-beta-2
3.0.1
3.0.2
3.0.3-beta-1
3.0.3-beta-2
3.0.3
3.0.4
3.0.5
3.0.6-beta-1
3.0.6
3.0.7
3.1.0-beta-1
3.1.0
3.2.0-alpha-1
3.2.0-alpha-2
3.2.0
3.2.1-beta-1
3.2.1
3.3.0
3.3.1-beta-1
3.3.1-beta-2
3.3.1
3.3.2
3.4.0-beta-1
3.4.0
3.4.1
3.4.2
3.4.3
3.5.0-beta-1
3.5.0
3.5.1-beta-1
3.5.1
3.5.2
3.5.3
3.5.4-beta-1
3.5.4
3.5.5
3.5.6
3.5.7-beta-1
3.5.7
3.5.8-beta-1
3.5.8
3.5.9
3.5.10
3.5.11
3.5.12-beta-1
3.5.12-beta-2
3.5.12-beta-3
3.5.12-beta-4
3.5.12
3.5.13
3.5.14
3.5.15-beta-1
3.5.15-beta-2
3.5.15-beta-3
3.5.15-beta-4
3.5.15
3.6.0-beta-1
3.6.0-beta-2
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4-beta-1
3.6.4
3.6.5-beta-1
3.6.5
3.6.6-beta-1
3.6.6-beta-2
3.6.6-beta-3
3.6.6-beta-4
3.6.6
3.6.7
3.6.8-beta-1
3.6.8-beta-2
3.6.8
3.6.9
3.6.10
3.6.11
3.6.12
3.6.13
3.6.14
3.6.15-beta-1
3.7.0-beta-1
3.7.0
3.7.1
3.8.0
3.8.1
3.8.2
3.8.3
3.9.0-beta-1
3.9.0
3.9.1
3.9.2
3.9.3
3.10.0
3.11.0-alpha-1
3.11.0
3.11.1
3.11.2
1161.*
1161.v89a_7dcec5d31
1195.*
1195.v3b_a_d1b_e792e0
1201.*
1201.v1fce0b_9b_a_e24
1203.*
1203.v75b_321f1c89f
1205.*
1205.vceea_7b_972817
1226.*
1226.v833b_d9f526b_9
1235.*
1235.v2db_ddd9f797b
1239.*
1239.v08f725b_927d9
1256.*
1256.v14a_6e1e0de4b
1257.*
1257.v89e586d3c58c
1274.*
1274.v870c8cb_fa_369
1279.*
1279.v5d711113020f
1290.*
1290.vf21c81e8c57f
1293.*
1293.v6c4d0ce54ee8
1298.*
1298.v43b_82f220a_e9
1314.*
1314.v09626b_14362f
1322.*
1322.v9ef317a_3e0a_9
1330.*
1330.v18e473854496

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-9v8g-f9mq-739g/GHSA-9v8g-f9mq-739g.json"
last_known_affected_version_range 
"<= 1330.v18e473854496"