Description

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.

Remediation

References

https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2429

Related Vulnerabilities

CVE-2023-3691 Vulnerability in npm package layui

CVE-2017-7556 Vulnerability in maven package io.hawt:project

CVE-2020-8135 Vulnerability in npm package @uppy/companion

CVE-2023-6291 Vulnerability in maven package org.keycloak:keycloak-services

CVE-2020-7654 Vulnerability in npm package snyk-broker

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Issue Tracking Vendor Advisory NVD-CWE-noinfo