CVE-2022-25184

Published: Feb 15, 2022Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs.

Affected (1)

Products: Jenkins: Pipeline\

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Pipeline\	Up to 2.15

Related CWEs

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (2)

https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2519

Source: jenkinsci-cert@googlegroups.com

PatchVendor Advisory

https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2519

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.