Read the docs
TI-2023-10997 Aliases CVE-2023-25722GHSA-fjrv-vx9m-4jpj

A credential-leak issue was discovered in related Veracode products before 2023-03-27.

Priority LOW 24CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

A credential-leak issue was discovered in related Veracode products before 2023-03-27. Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remote agent jobs, invokes the Veracode Java API Wrapper in a manner that allows local users (with OS-level access of the Jenkins remote) to discover Veracode API credentials by listing the process and its arguments. Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remote agent jobs and when the "Connect using proxy" option is enabled and configured with proxy credentials, allows local users of the Jenkins remote to discover proxy credentials by listing the process and its arguments. Veracode Azure DevOps Extension before 3.20.0 invokes the Veracode Java API Wrapper in a manner that allows local users (with OS-level access to the Azure DevOps Services cloud infrastructure or Azure DevOps Server) to discover Veracode API credentials by listing the process and its arguments. Veracode Azure DevOps Extension before 3.20.0, when configured with proxy credentials, allows users (with shell access to the Azure DevOps Services cloud infrastructure or Azure DevOps Server) to discover proxy credentials by listing the process and its arguments.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00206 10th percentileScored 2026-11-07
Fix Fixed com.veracode.jenkins:veracode-scan (Maven): 23.3.19.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.veracode.jenkins:veracode-scan (Maven)before 23.3.19.023.3.19.0Patch availableGHSA-fjrv-vx9m-4jpj
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.veracode.jenkins:veracode-scan (Maven) Vendor— Affected before 23.3.19.0 Fixed in 23.3.19.0 Patch available GHSA-fjrv-vx9m-4jpj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:veracode:veracode:*:*:*:*:*:jenkins:*:*before 23.3.19.0VulnerableVeracode
  • cpe:2.3:a:veracode:veracode:*:*:*:*:*:jenkins:*:* Versions before 23.3.19.0 Vulnerable ·Veracode

Remediation

  • Fix · GHSA-fjrv-vx9m-4jpj com.veracode.jenkins:veracode-scan (Maven) Fixed in 23.3.19.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25722
  2. 2026-10-03 Alias added: GHSA-fjrv-vx9m-4jpj

References

Advisory 2

Other 3

  • TI-2023-10996 Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Connect using proxy" option is… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences