CVE-2023-25721

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Connect using proxy" option is enabled and configured with proxy credentials and when the Jenkins global system setting debug is enabled and when a scan is configured for remote agent jobs, allows users (with access to view the job log) to discover proxy credentials.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Mar 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-257225.5A credential-leak issue was discovered in related Veracode products before 2023-03-27. Veracode Scan Jenkins Plugin before 23.3.19.0, when c CVE-2023-257259.1HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smu CVE-2023-257275.4In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-an CVE-2023-257286.5The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted URI when interaction CVE-2023-257298.8Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to ope CVE-2023-25738.8Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field CVE-2023-257305.4A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode i CVE-2023-257318.8Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite CVE-2023-257328.8When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated p CVE-2023-257337.5The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference.CVE-2023-257348.1After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to CVE-2023-257358.8Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment