4.3
CVE-2022-25180
- EPSS 0.51%
- Veröffentlicht 15.02.2022 17:15:08
- Zuletzt bearbeitet 21.11.2024 06:51:45
- Quelle jenkinsci-cert@googlegroups.co
- Teams Watchlist Login
- Unerledigt Login
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jenkins ≫ Pipeline: Groovy SwPlatformjenkins Version <= 2648.va9433432b33c
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
Typ | Quelle | Score | Percentile |
---|---|---|---|
EPSS | FIRST.org | 0.51% | 0.656 |
Quelle | Base Score | Exploit Score | Impact Score | Vector String |
---|---|---|---|---|
nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
nvd@nist.gov | 4 | 8 | 2.9 |
AV:N/AC:L/Au:S/C:P/I:N/A:N
|
CWE-319 Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.