CVE-2022-38663: Jenkins Git

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.

Affected products

• Jenkins Git: up to and including 4.11.4

Published 2022-08-23. Last modified 2026-06-17.