Junglewise Threat Intelligence

CVE-2022-25190: Missing permission check in Jenkins Conjur Secrets Plugin allows enumerating credentials IDs

CVE-2022-25190 · Severity: low · CVSS 3.1 · Published 2022-02-16

Technologies: org.conjur.jenkins:conjur-credentials (Maven). Vendors: Maven.

Executive brief

Missing permission check in Jenkins Conjur Secrets Plugin allows enumerating credentials IDs

Affected products

Maven org.conjur.jenkins:conjur-credentials

Related threats

Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials
Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows decrypting secrets