Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-hp27-w6wh-3ya6
Vulnerability ID VCID-hp27-w6wh-3ya6
Aliases CVE-2022-25184
GHSA-g84f-cmc8-682c
Summary Password parameter default values exposed by Jenkins Pipeline: Build Step Plugin Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-522 Insufficiently Protected Credentials
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-25184.json
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2022-25184
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2022-25184
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2022-25184
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2022-25184
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2022-25184
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2022-25184
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2022-25184
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2022-25184
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2022-25184
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2022-25184
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2022-25184
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2022-25184
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2022-25184
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2022-25184
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-g84f-cmc8-682c
cvssv3.1 4.3 https://github.com/jenkinsci/pipeline-build-step-plugin
generic_textual MODERATE https://github.com/jenkinsci/pipeline-build-step-plugin
cvssv3.1 4.3 https://github.com/jenkinsci/pipeline-build-step-plugin/commit/c06f65425fe9696d2237f591959dd4b5c6083fd9
generic_textual MODERATE https://github.com/jenkinsci/pipeline-build-step-plugin/commit/c06f65425fe9696d2237f591959dd4b5c6083fd9
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2022-25184
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-25184
cvssv3.1 4.3 https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2519
generic_textual MODERATE https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2519
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-25184.json
https://api.first.org/data/v1/epss?cve=CVE-2022-25184
https://github.com/jenkinsci/pipeline-build-step-plugin
https://github.com/jenkinsci/pipeline-build-step-plugin/commit/c06f65425fe9696d2237f591959dd4b5c6083fd9
https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2519
2055804 https://bugzilla.redhat.com/show_bug.cgi?id=2055804
CVE-2022-25184 https://nvd.nist.gov/vuln/detail/CVE-2022-25184
GHSA-g84f-cmc8-682c https://github.com/advisories/GHSA-g84f-cmc8-682c
RHSA-2022:0871 https://access.redhat.com/errata/RHSA-2022:0871
RHSA-2022:1021 https://access.redhat.com/errata/RHSA-2022:1021
RHSA-2022:1025 https://access.redhat.com/errata/RHSA-2022:1025
RHSA-2022:1248 https://access.redhat.com/errata/RHSA-2022:1248
RHSA-2022:1420 https://access.redhat.com/errata/RHSA-2022:1420
RHSA-2022:1620 https://access.redhat.com/errata/RHSA-2022:1620
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-25184.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/jenkinsci/pipeline-build-step-plugin
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/jenkinsci/pipeline-build-step-plugin/commit/c06f65425fe9696d2237f591959dd4b5c6083fd9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-25184
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2519
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.25338
EPSS Score 0.00088
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:49:34.242111+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.jenkins-ci.plugins/pipeline-build-step/CVE-2022-25184.yml 38.0.0