Read the docs
TI-2023-10996 Aliases CVE-2023-25721GHSA-c4jr-vjm4-27hq

Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Connect using proxy" option is…

Priority LOW 30CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Connect using proxy" option is enabled and configured with proxy credentials and when the Jenkins global system setting debug is enabled and when a scan is configured for remote agent jobs, allows users (with access to view the job log) to discover proxy credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00647 51st percentileScored 2026-11-07
Fix Fixed com.veracode.jenkins:veracode-scan (Maven): 23.3.19.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.veracode.jenkins:veracode-scan (Maven)before 23.3.19.023.3.19.0Patch availableGHSA-c4jr-vjm4-27hq
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.veracode.jenkins:veracode-scan (Maven) Vendor— Affected before 23.3.19.0 Fixed in 23.3.19.0 Patch available GHSA-c4jr-vjm4-27hq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:veracode:veracode:*:*:*:*:*:jenkins:*:*before 23.3.19.0VulnerableVeracode
  • cpe:2.3:a:veracode:veracode:*:*:*:*:*:jenkins:*:* Versions before 23.3.19.0 Vulnerable ·Veracode

Remediation

  • Fix · GHSA-c4jr-vjm4-27hq com.veracode.jenkins:veracode-scan (Maven) Fixed in 23.3.19.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25721
  2. 2026-10-03 Alias added: GHSA-c4jr-vjm4-27hq
  3. 2026-10-19 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 3

  • TI-2023-10997 A credential-leak issue was discovered in related Veracode products before 2023-03-27. CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences