Password written to the build log by Jenkins SQLPlus Script Runner Plugin

MEDIUM 6.5CVE-2020-2312 · GHSA-rwh3-5g7v-3c5m · Published 04/11/2020 · updated 17/06/2026

In short

CVE-2020-2312 is a MEDIUM (CVSS 6.5) vulnerability affecting org.jenkins-ci.plugins:sqlplus-script-runner, sqlplus script runner (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.99%, higher than 62.6% of all vulnerabilities.
Fix: update to 2.0.13 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:sqlplus-script-runner Maven	`< 2.0.13`	`2.0.13`
sqlplus script runner jenkins	`≤ 2.0.12`	No fix yet

Description

Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier prints the sqlplus command invocation to the build logs.

This log message does not redact a password provided as part of a command line argument. This password can be viewed by users with Item/Read permission.

Jenkins SQLPlus Script Runner Plugin 2.0.13 no longer prints the password in the build logs.

NVD description

Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs.

References

nvd.nist.gov/vuln/detail/CVE-2020-2312 · ADVISORY
jenkinsci/sqlplus-script-runner-plugin · PACKAGE
jenkins.io/security/advisory/2020-11-04 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free