GitHub Advisoryadvisory · Maven

GHSA-g7fx-mmjc-r7gv Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows decrypting secrets

MEDIUM Published 2022-01-13 Modified 2022-11-29 Official page ↗
Aliases
CVE-2022-23116
Ecosystem
Maven
Packages
org.conjur.jenkins:conjur-credentials
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-311
Reviewed
2022-11-29

Affected packages

• Maven org.conjur.jenkins:conjur-credentials: < 1.0.10 → fixed in 1.0.10

Description

Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt secrets stored in Jenkins obtained through another method.

Related

Alias · CVE (1)

  • CVE-2022-23116 Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt… vulnerability

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

References