GHSA-fm6q-97gw-c4wh

ghsaUSosv

Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin

view advisory published 2022-02-16Licence: CC-BY-4.0

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-25186US	medium6.5	0.81% (57th)	—	2022-02-15
Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to…

references

External citations — patches, advisories, analysis.

https://github.com/jenkinsci/hashicorp-vault-pluginPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2022-25186ADVISORY
https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2429WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan