CVE-2023-25721

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-28 · updated 2026-06-17
Weakness: CWE-532

Description

Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Connect using proxy" option is enabled and configured with proxy credentials and when the Jenkins global system setting debug is enabled and when a scan is configured for remote agent jobs, allows users (with access to view the job log) to discover proxy credentials.

Affected products

Veracode: before 23.3.19.0 — fixed in 23.3.19.0

How to fix

Upgrade to a fixed version: Veracode 23.3.19.0. Check the vendor advisory for mitigations.

References

https://docs.veracode.com/updates/r/c_all_int#veracode-jenkins-plugin-233190
https://veracode.com
https://docs.veracode.com/updates/r/c_all_int#veracode-jenkins-plugin-233190
https://veracode.com

Get alerted when CVE-2023-25721 or the next vulnerability affects your stack