GHSA-xfx3-cr74-x3cv

Suggest an improvement
Source
https://github.com/advisories/GHSA-xfx3-cr74-x3cv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-xfx3-cr74-x3cv/GHSA-xfx3-cr74-x3cv.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-xfx3-cr74-x3cv
Aliases
Published
2024-06-26T18:30:28Z
Modified
2026-08-07T08:12:08Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Exposure of secrets through system log in Jenkins Structs Plugin
Details

Structs Plugin provides utility functionality used, e.g., in Pipeline to instantiate and configure build steps, typically before their execution.

When Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that may contain secrets passed as step parameters.

This can result in accidental exposure of secrets through the default system log.

Structs Plugin 338.v848422169819 inspects the types of actual parameters before logging these warning messages, and limits detailed diagnostic information to FINE level log messages if secrets are involved. These log messages are not displayed in the default Jenkins system log.

Database specific 
{
    "cwe_ids": [
        "CWE-200",
        "CWE-209"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-26T20:03:44Z",
    "nvd_published_at": "2024-06-26T17:15:27Z",
    "severity": "LOW"
}
References

Affected packages

Maven / org.jenkins-ci.plugins:structs

Package

Name
org.jenkins-ci.plugins:structs
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/structs

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
338.v848422169819

Affected versions

1.*
1.1
1.1.1
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9
1.10
1.12
1.13
1.14
1.15
1.16
1.17
1.18
1.19
1.20
1.21
1.22
1.23
1.24
308.*
308.v852b473a2b8c
317.*
317.vf68c51f71b_e2
318.*
318.va_f3ccb_729b_71
324.*
324.va_f5d6774f3a_d
325.*
325.vcb_307d2a_2782
337.*
337.v1b_04ea_4df7c8

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-xfx3-cr74-x3cv/GHSA-xfx3-cr74-x3cv.json"