Executive brief
Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests
Affected products
- Maven com.datapipe.jenkins.plugins:hashicorp-vault-plugin
Junglewise Threat Intelligence
CVE-2022-36888: Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests
CVE-2022-36888 · Severity: low · CVSS 3.1 · Published 2022-07-28
Technologies: com.datapipe.jenkins.plugins:hashicorp-vault-plugin (Maven). Vendors: Maven.
Related threats
- Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials
- Jenkins HashiCorp Vault Plugin has improper masking of credentials
- Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin
- Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin allows reading arbitrary files
- Improper credentials masking in Jenkins HashiCorp Vault Plugin