Improper credentials masking in Jenkins HashiCorp Vault Plugin
Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-23109US | medium6.5 | — | ||
Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2022/01/12/6WEB
- https://github.com/jenkinsci/hashicorp-vault-pluginPACKAGE
- https://github.com/jenkinsci/hashicorp-vault-plugin/commit/c7ad9779320bd8640d83790a985ebab240249b13WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-23109ADVISORY
- https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2213WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan