Medium · 5.3 CVE-2022-23117 EUVD-2022-0567GHSA-cw68-xmm4-c83r

Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials

Published Jan 12, 2022 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Conjur Secrets Plugin Package: org.conjur.jenkins:conjur-credentials Category: Web / CMS Ecosystem: Maven

Description

Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/password credentials stored on the Jenkins controller.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Conjur Secrets Plugin	unspecified – ≤ 1.0.9	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.conjur.jenkins:conjur-credentials	< 1.0.10	1.0.10	GHSA-cw68-xmm4-c83r

References

https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2522%20%282%29
[oss-security] 20220112 Multiple vulnerabilities in Jenkins and Jenkins plugins mailing-list