CVE-2022-25184: Infoleak
A flaw was found in Jenkins pipeline-build-step where it revealed password parameter default values when generating a pipeline script using the Pipeline snippet generator. This flaw allows attackers with item/read permission to retrieve the default password parameter value from jobs and compromises confidentiality.
Other sources
Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs.
Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator. This allows attackers with Item/Read permission to retrieve the default password parameter value from jobs.
References:
https://www.jenkins.io/security/advisory/2022-02-15/
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-25184?
CVE-2022-25184 has been classified as a medium severity vulnerability.
How do I fix CVE-2022-25184?
To remediate CVE-2022-25184, update Jenkins Pipeline: Build Step Plugin to version 2.16 or later.
What types of permissions are required to exploit CVE-2022-25184?
An attacker needs Item/Read permissions to exploit CVE-2022-25184.
What are the consequences of CVE-2022-25184?
CVE-2022-25184 allows unauthorized users to retrieve default password values, potentially compromising security.
Which versions of Jenkins are affected by CVE-2022-25184?
CVE-2022-25184 affects Jenkins Pipeline: Build Step Plugin versions 2.15 and earlier.