Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.

Threat-Mapped Scoring

Score: 3.0

Priority: P2 - Serious (High)

• S1 – Steal Customer Account Information

EPSS

Score: 0.01474
Percentile: 0.80091

CVSS Scoring

Affected Products

• cpe:2.3:a:jenkins:parameterized_trigger:*:*:*:*:*:jenkins:*:*

← Back to Home