GitHub Advisoryadvisory · Maven

GHSA-fm6q-97gw-c4wh Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin

LOW Published 2022-02-16 Modified 2022-12-01 Official page ↗
Aliases
CVE-2022-25186
Ecosystem
Maven
Packages
com.datapipe.jenkins.plugins:hashicorp-vault-plugin
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-693
Reviewed
2022-02-16

Affected packages

• Maven com.datapipe.jenkins.plugins:hashicorp-vault-plugin: < 336.v182c0fbaaeb7 → fixed in 336.v182c0fbaaeb7

Description

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.

Related

Alias · CVE (1)

  • CVE-2022-25186 Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use… vulnerability

Weakness · CWE (1)

  • CWE-693 Protection Mechanism Failure weakness

References