Every CVE Search/ Get API key

CVE-2022-25184

Password parameter default values exposed by Jenkins Pipeline: Build Step Plugin

6.5 MediumFix available

Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.88%Unchanged since Feb 16, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs.

Record
CVE-2022-25184
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
CVE List No score

Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs.

Record
CVE-2022-25184
Updated
2026-11-02
EUVDEUVD-2022-1003 No score

Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs.

Record
EUVD-2022-1003
Updated
2026-11-03
GitHub AdvisoriesGHSA-g84f-cmc8-682c 4.3

Password parameter default values exposed by Jenkins Pipeline: Build Step Plugin

Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs.

Record
GHSA-g84f-cmc8-682c
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
OSV 6.5

Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs.

Record
CVE-2022-25184
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-g84f-cmc8-682c 4.3

Password parameter default values exposed by Jenkins Pipeline: Build Step Plugin

Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs.

Record
GHSA-g84f-cmc8-682c
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2022:0871 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.8.35 security update

Record
RHSA-2022:0871
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:1021 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.9.26 security update

Record
RHSA-2022:1021
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:1025 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.10.6 security update

Record
RHSA-2022:1025
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:1248 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.7.48 packages and security update

Record
RHSA-2022:1248
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:1420 8.8

Red Hat Security Advisory: OpenShift Container Platform 3.11.685 security and bug fix update

Record
RHSA-2022:1420
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:1620 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.6.57 packages and security update

Record
RHSA-2022:1620
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.plugins:pipeline-build-step
Maven
 before 2.15.1
2.15.1
org.jenkins-ci.plugins:pipeline-build-step
Maven
 before 2.15.1, plus listed versions
2.02.12.102.112.12
Show 13 moreShow less
2.132.13.12.142.152.22.32.42.52.5.12.62.72.82.9
2.15.1
cri-o
Red Hat:openshift:4.8::el7
From an advisory covering 15 CVEs
 before 0:1.21.5-3.rhaos4.8.gitaf64931.el7
0:1.21.5-3.rhaos4.8.gitaf64931.el7
cri-o-debuginfo
Red Hat:openshift:4.8::el7
From an advisory covering 15 CVEs
 before 0:1.21.5-3.rhaos4.8.gitaf64931.el7
0:1.21.5-3.rhaos4.8.gitaf64931.el7
cri-o
Red Hat:openshift:4.8::el8
From an advisory covering 15 CVEs
 before 0:1.21.5-3.rhaos4.8.gitaf64931.el8
0:1.21.5-3.rhaos4.8.gitaf64931.el8
cri-o-debuginfo
Red Hat:openshift:4.8::el8
From an advisory covering 15 CVEs
 before 0:1.21.5-3.rhaos4.8.gitaf64931.el8
0:1.21.5-3.rhaos4.8.gitaf64931.el8
cri-o-debugsource
Red Hat:openshift:4.8::el8
From an advisory covering 15 CVEs
 before 0:1.21.5-3.rhaos4.8.gitaf64931.el8
0:1.21.5-3.rhaos4.8.gitaf64931.el8
jenkins-2-plugins
Red Hat:openshift:4.8::el8
From an advisory covering 15 CVEs
 before 0:4.8.1646993358-1.el8
0:4.8.1646993358-1.el8
haproxy
Red Hat:openshift:4.9::el8
From an advisory covering 13 CVEs
 before 0:2.2.15-4.el8
0:2.2.15-4.el8
haproxy-debugsource
Red Hat:openshift:4.9::el8
From an advisory covering 13 CVEs
 before 0:2.2.15-4.el8
0:2.2.15-4.el8
Show 15 moreShow less
Affected packages
PackageAffectedFixed
haproxy22
Red Hat:openshift:4.9::el8
From an advisory covering 13 CVEs
 before 0:2.2.15-4.el8
0:2.2.15-4.el8
haproxy22-debuginfo
Red Hat:openshift:4.9::el8
From an advisory covering 13 CVEs
 before 0:2.2.15-4.el8
0:2.2.15-4.el8
jenkins-2-plugins
Red Hat:openshift:4.9::el8
From an advisory covering 13 CVEs
 before 0:4.9.1647580879-1.el8
0:4.9.1647580879-1.el8
jenkins-2-plugins
Red Hat:openshift:4.10::el8
From an advisory covering 12 CVEs
 before 0:4.10.1647505461-1.el8
0:4.10.1647505461-1.el8
jenkins-2-plugins
Red Hat:openshift:4.7::el8
From an advisory covering 12 CVEs
 before 0:4.7.1648800585-1.el8
0:4.7.1648800585-1.el8
jenkins
Red Hat:openshift:3.11::el7
From an advisory covering 13 CVEs
 before 0:2.319.3.1650348949-1.el7
0:2.319.3.1650348949-1.el7
jenkins-2-plugins
Red Hat:openshift:3.11::el7
From an advisory covering 13 CVEs
 before 0:3.11.1650371376-1.el7
0:3.11.1650371376-1.el7
haproxy
Red Hat:openshift:4.6::el7
From an advisory covering 13 CVEs
 before 0:2.0.16-3.el7
0:2.0.16-3.el7
haproxy-debuginfo
Red Hat:openshift:4.6::el7
From an advisory covering 13 CVEs
 before 0:2.0.16-3.el7
0:2.0.16-3.el7
haproxy20
Red Hat:openshift:4.6::el7
From an advisory covering 13 CVEs
 before 0:2.0.16-3.el7
0:2.0.16-3.el7
haproxy
Red Hat:openshift:4.6::el8
From an advisory covering 13 CVEs
 before 0:2.0.16-5.el8
0:2.0.16-5.el8
haproxy-debugsource
Red Hat:openshift:4.6::el8
From an advisory covering 13 CVEs
 before 0:2.0.16-5.el8
0:2.0.16-5.el8
haproxy20
Red Hat:openshift:4.6::el8
From an advisory covering 13 CVEs
 before 0:2.0.16-5.el8
0:2.0.16-5.el8
haproxy20-debuginfo
Red Hat:openshift:4.6::el8
From an advisory covering 13 CVEs
 before 0:2.0.16-5.el8
0:2.0.16-5.el8
jenkins-2-plugins
Red Hat:openshift:4.6::el8
From an advisory covering 13 CVEs
 before 0:4.6.1650364520-1.el8
0:4.6.1650364520-1.el8

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-25184 is a medium vulnerability (CVSS 6.5) in Jenkins Project Pipeline: Build Step Plugin, published February 15, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in org.jenkins-ci.plugins:pipeline-build-step 2.15.1.

References

Show 84 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open