CVE-2022-38663: Improper masking of credentials in Jenkins Git Plugin
Summary
CVE-2022-38663: Improper masking of credentials Jenkins in Git Plugin. Affects org.jenkins-ci.plugins:git versions < 4.11.5. Fixed in 4.11.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Git Plugin is a plugin for the Jenkins automation server that allows users to integrate Git repositories into their build processes. It provides functionality for cloning Git repositories, checking out specific branches or commits, and performing other Git-related operations. The plugin is widely used in software development and continuous integration workflows.
Vulnerability Detail
The Jenkins Git Plugin version 4.11.4 and earlier suffer from an improper masking of credentials vulnerability. This vulnerability occurs when the plugin fails to properly mask sensitive information, such as usernames and passwords, in the build log provided by the Git Username and Password (gitUsernamePassword) credentials binding. As a result, these credentials may be exposed in plain text in the build log, potentially leading to unauthorized access to sensitive resources or accounts.
How To Fix
Latest published version: 5.11.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.11.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually modify their Jenkins configuration to prevent the exposure of credentials in the build log. This can be achieved by disabling the Git Username and Password (gitUsernamePassword) credentials binding or using alternative methods for managing Git credentials, such as SSH keys or token-based authentication. Here's an example of how to disable the credentials binding in the Jenkinsfile:
pipeline {
agent any
stages {
stage('Build') {
steps {
// Disable Git credentials binding
git credentialsId: '', url: 'https://github.com/example/repo.git'
}
}
}
}
Conclusion
In conclusion, the Jenkins Git Plugin version 4.11.4 and earlier suffer from an improper masking of credentials vulnerability. This vulnerability can potentially expose sensitive credentials in the build log, leading to unauthorized access to resources or accounts. Users are advised to upgrade to version 4.11.5 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:git →
FAQ
This vulnerability can potentially expose sensitive credentials, such as usernames and passwords, in the build log. Attackers with access to the build log may be able to use these credentials to gain unauthorized access to resources or accounts.
If you are using Jenkins Git Plugin version 4.11.4 or earlier, your instance is affected by this vulnerability. It is recommended to upgrade to version 4.11.5 or later to mitigate the risk.
No, manual masking of credentials in the build log is not recommended as it may introduce human error and is not a reliable solution. It is best to upgrade to the fixed version of the Jenkins Git Plugin.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is always recommended to promptly apply security updates to mitigate the risk of potential exploits.
You can find more information about this vulnerability in the GitHub Security Advisory database. The advisory for this vulnerability can be accessed at: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-jxmw-3gxf-fprh/GHSA-jxmw-3gxf-fprh.json
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:git.
