CVE-2022-25180: Insufficiently Protected Credentials in Jenkins Pipeline: Groovy Plugin
Summary
CVE-2022-25180: Jenkins Pipeline: Groovy Plugin has Insufficiently Protected Credentials. Affects org.jenkins-ci.plugins.workflow:workflow-cps versions < 2656.vf7a_e7b_75a_457. Fixed in 2656.vf7a_e7b_75a_457. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Pipeline: Groovy Plugin is a plugin for Jenkins, an open-source automation server. It allows users to define their build process using a Groovy-based domain-specific language (DSL). The plugin provides a powerful and flexible way to create continuous delivery pipelines. However, versions 2648.va9433432b33c and earlier of the plugin have a vulnerability that exposes password parameters from the original build in replayed builds. This means that attackers with Run/Replay permission can obtain the values of password parameters passed to previous builds of a Pipeline.
Vulnerability Detail
The vulnerability in Jenkins Pipeline: Groovy Plugin allows attackers with Run/Replay permission to access the values of password parameters passed to previous builds of a Pipeline. This can lead to the exposure of sensitive credentials, potentially compromising the security of the system. The issue arises from the plugin's failure to adequately protect the credentials used in the build process. As a result, an attacker can replay a previous build and retrieve the password values, even if they were not explicitly passed as parameters in the replayed build.
How To Fix
Latest published version: 4395.v738456a_5da_6b_ as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2656.vf7a_e7b_75a_457
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Jenkins Pipeline: Groovy Plugin to the fixed version.
Conclusion
The vulnerability in Jenkins Pipeline: Groovy Plugin exposes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permission to obtain sensitive credentials. To mitigate this risk, users should update to version 2648.2651.v230593e03e9f or later of the plugin. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.workflow:workflow-cps →
FAQ
This vulnerability allows attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline. This can lead to the exposure of sensitive credentials, potentially compromising the security of the system.
Users of Jenkins Pipeline: Groovy Plugin versions 2648.va9433432b33c and earlier are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to update the Jenkins Pipeline: Groovy Plugin to the fixed version.
The only effective mitigation for this vulnerability is to update the Jenkins Pipeline: Groovy Plugin to version 2648.2651.v230593e03e9f or later.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-qv6q-x9vr-w7j3/GHSA-qv6q-x9vr-w7j3.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.workflow:workflow-cps.
