Login Request a demo
Medium severity · published Aug 23, 2022
CVE-2022-38663
Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password…
6.5
CVSS
0.9%
EPSS
No
On KEV
Description
Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
Git · Jenkins
through 4.11.4 · source: NVD
Affected product
GI
Git
Jenkins
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-38663
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-38663
Mailing List
http://www.openwall.com/lists/oss-security/2022/08/23/2
Vendor Advisory
https://www.jenkins.io/security/advisory/2022-08-23/#SECURITY-2796
More from Git
8.8
CVE-2022-36882
A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git…
7.5
CVE-2022-36883
A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git…
7.5
CVE-2022-30947
Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local…
7.5
CVE-2017-1000092
Git Plugin connects to a user-specified Git repository as part of form validation
6.4
CVE-2018-1000182
A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java,…