GHSA-qv6q-x9vr-w7j3
GitHub Security Advisory
Jenkins Pipeline: Groovy Plugin has Insufficiently Protected Credentials
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds.
This allows attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.
Pipeline: Groovy Plugin 2656.vf7a_e7b_75a_457 does not allow builds containing password parameters to be replayed.
Affected Packages
Maven
org.jenkins-ci.plugins.workflow:workflow-cps
Affected versions:
0
(fixed in 2656.vf7a_e7b_75a_457)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: July 2, 2025 6:26 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.