CVE-2023-25722

Veracode Scan Jenkins Plugin vulnerable to information disclosure

5.5 MediumFix available

A credential-leak issue was discovered in related Veracode products before 2023-03-27. Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remote agent jobs, invokes the Veracode Java API Wrapper in a manner that allows local users (with OS-level access of the Jenkins remote) to discover Veracode API credentials by listing the process and its arguments. Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remote agent jobs and when the "Connect using proxy" option is enabled and configured with proxy credentials, allows local users of the Jenkins remote to discover proxy credentials by listing the process and its arguments. Veracode Azure DevOps Extension before 3.20.0 invokes the Veracode Java API Wrapper in a manner that allows local users (with OS-level access to the Azure DevOps Services cloud infrastructure or Azure DevOps Server) to discover Veracode API credentials by listing the process and its arguments. Veracode Azure DevOps Extension before 3.20.0, when configured with proxy credentials, allows users (with shell access to the Azure DevOps Services cloud infrastructure or Azure DevOps Server) to discover proxy credentials by listing the process and its arguments.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.21%Up 0.2 points since Mar 29, 2023

What each source reports

NVD Score used 5.5

Record: CVE-2023-25722
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List 5.5

Record: CVE-2023-25722
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

EUVDEUVD-2023-1000 5.5

Record: EUVD-2023-1000
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-fjrv-vx9m-4jpj 5.5

Veracode Scan Jenkins Plugin vulnerable to information disclosure

Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remote agent jobs, invokes the Veracode Java API Wrapper in a manner that allows local users (with OS-level access of the Jenkins remote) to discover Veracode API credentials by listing the process and its arguments.

Record: GHSA-fjrv-vx9m-4jpj
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-214
Updated: 2026-11-02

OSVGHSA-fjrv-vx9m-4jpj 5.5

Veracode Scan Jenkins Plugin vulnerable to information disclosure

Record: GHSA-fjrv-vx9m-4jpj
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-214
Updated: 2026-11-02

Affected products

veracode

Affected packages

Affected packages
Package	Affected	Fixed
`com.veracode.jenkins:veracode-scan` Maven	before 23.3.19.0	23.3.19.0
`com.veracode.jenkins:veracode-scan` Maven	before 23.3.19.0, plus listed versions 1.0.5-alpha20.6.10.020.6.10.0-alpha20.6.10.2-alpha20.9.11.0 Show 9 moreShow less 21.12.17.021.2.12.021.6.13.021.7.14.021.8.15.021.9.16.022.2.17.122.5.17.222.6.18.0	23.3.19.0

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-25722 is a medium vulnerability (CVSS 5.5) in Veracode, published March 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in com.veracode.jenkins:veracode-scan 23.3.19.0.