Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2020-2181

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps.

VectorNETWORK

PublishedMay 06, 2020, 13:15

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score6.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.jenkins-ci.plugins:credentials-binding(Maven)01.23N/A

References

http://www.openwall.com/lists/oss-security/2020/05/06/3
https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1374

Weakness Type

CWE-522

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK