Incorrect control flow in Jenkins Gradle Plugin breaks credentials masking in the build log

MEDIUM 6.5CVE-2023-39152 · GHSA-pvjf-4hfg-wr84 · Published 26/07/2023 · updated 17/06/2026

In short

CVE-2023-39152 is a MEDIUM (CVSS 6.5) vulnerability affecting org.jenkins-ci.plugins:gradle, gradle (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.77%, higher than 55.7% of all vulnerabilities.
Fix: update to 2.8.1 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:gradle Maven	`< 2.8.1`	`2.8.1`
gradle jenkins	`= 2.8`	No fix yet

Description

Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.

NVD description

Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.

References

nvd.nist.gov/vuln/detail/CVE-2023-39152 · ADVISORY
jenkins.io/security/advisory/2023-07-26 · WEB
openwall.com/lists/oss-security/2023/07/26/2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free