Executive brief
Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin
Affected products
- Maven com.datapipe.jenkins.plugins:hashicorp-vault-plugin
Junglewise Threat Intelligence
CVE-2022-25186: Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin
CVE-2022-25186 · Severity: low · CVSS 3.1 · Published 2022-02-16
Technologies: com.datapipe.jenkins.plugins:hashicorp-vault-plugin (Maven). Vendors: Maven.
Related threats
- Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials
- Jenkins HashiCorp Vault Plugin has improper masking of credentials
- Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests
- Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin allows reading arbitrary files
- Improper credentials masking in Jenkins HashiCorp Vault Plugin