Jenkins Gradle Plugin
Monthly
Information disclosure in Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier lets an authenticated Jenkins user who can influence the build log of a Gradle job trick the plugin into fetching build scan data from an attacker-controlled URL in preference to the Develocity server URL set in the plugin's global configuration. Because the plugin attaches the globally configured Develocity access key to that outbound request, the attacker can capture the credential; instances with no Develocity access key configured have nothing to leak, so exposure is conditional rather than universal. No public exploit code has been identified at time of analysis, and this is a genuine but moderate-severity issue: exploitation requires authenticated job-run or job-configure privileges plus a configured access key, and the resulting impact is limited to confidentiality (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Information disclosure in Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier lets an authenticated Jenkins user who can influence the build log of a Gradle job trick the plugin into fetching build scan data from an attacker-controlled URL in preference to the Develocity server URL set in the plugin's global configuration. Because the plugin attaches the globally configured Develocity access key to that outbound request, the attacker can capture the credential; instances with no Develocity access key configured have nothing to leak, so exposure is conditional rather than universal. No public exploit code has been identified at time of analysis, and this is a genuine but moderate-severity issue: exploitation requires authenticated job-run or job-configure privileges plus a configured access key, and the resulting impact is limited to confidentiality (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).