Description

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.

Remediation

References

https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2429

Related Vulnerabilities

CVE-2020-13444 Vulnerability in maven package com.liferay:com.liferay.dynamic.data.mapping.service

CVE-2023-45138 Vulnerability in maven package org.xwiki.contrib.changerequest:application-changerequest-ui

CVE-2018-14042 Vulnerability in maven package org.fujion.webjars:bootstrap

CVE-2021-3918 Vulnerability in npm package json-schema

CVE-2023-31126 Vulnerability in maven package org.xwiki.commons:xwiki-commons-xml

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Issue Tracking Vendor Advisory NVD-CWE-noinfo