CVE-2022-25187
Jenkins Support Core Plugin stores sensitive data in plain text
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.
- Record
CVE-2022-25187- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-212
- Updated
- 2026-11-02
CVE List No score
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.
- Record
CVE-2022-25187- Updated
- 2026-11-02
EUVDEUVD-2022-0841 No score
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.
- Record
EUVD-2022-0841- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5m8f-v3gw-h94w
Jenkins Support Core Plugin stores sensitive data in plain text
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle. Support Core Plugin 2.79.1 adds a list of keywords whose associated values are redacted.
- Record
GHSA-5m8f-v3gw-h94w- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-212, CWE-312, CWE-522
- Updated
- 2026-11-02
OSV
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.
- Record
CVE-2022-25187- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-5m8f-v3gw-h94w
Jenkins Support Core Plugin stores sensitive data in plain text
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle. Support Core Plugin 2.79.1 adds a list of keywords whose associated values are redacted.
- Record
GHSA-5m8f-v3gw-h94w- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-212, CWE-312, CWE-522
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:support-coreMaven |
before 2.79.1 | 2.79.1 |
org.jenkins-ci.plugins:support-coreMaven |
before 2.79.1, plus listed versions 1.01.11.21.31.4 Show 45 moreShow less1.51.61.71.82.02.12.102.112.122.132.142.152.162.172.182.192.202.212.222.242.252.272.282.292.32.302.312.322.332.342.352.362.372.382.392.42.402.412.422.432.442.452.45.12.462.47 |
2.79.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-25187 is a medium vulnerability (CVSS 6.5) in Jenkins Support Core, published February 15, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 61st percentile. Fixed in org.jenkins-ci.plugins:support-core 2.79.1.
References
jenkins.io/security/advisory/2022-02-15
nvd.nist.gov/vuln/detail/CVE-2022-25187
github.com/jenkinsci/support-core-plugin/commit/c6d20da4f372f03bd3e4844f0df2f109df68a63c
Left out here: 45 versions. The JSON record has them.