Description
Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
Remediation
References
http://www.openwall.com/lists/oss-security/2023/04/13/3
https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-3075
Related Vulnerabilities
CVE-2020-26870 Vulnerability in maven package org.webjars.bowergithub.cure53:dompurify
CVE-2020-9489 Vulnerability in maven package org.apache.tika:tika-parsers
CVE-2019-1010091 Vulnerability in maven package org.webjars:tinymce
CVE-2023-28326 Vulnerability in maven package org.apache.openmeetings:openmeetings-parent
CVE-2024-36401 Vulnerability in maven package org.geoserver.web:gs-web-app