Medium · 5.3 CVE-2022-25197 EUVD-2022-0757GHSA-2587-w93g-63m2

Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin allows reading arbitrary files

Published Feb 15, 2022 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins HashiCorp Vault Plugin Package: com.datapipe.jenkins.plugins:hashicorp-vault-plugin Category: Web / CMS Ecosystem: Maven

Description

Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins HashiCorp Vault Plugin	unspecified – ≤ 336.v182c0fbaaeb7	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	com.datapipe.jenkins.plugins:hashicorp-vault-plugin	< 351.vdb_f83a_1c6a_9d	351.vdb_f83a_1c6a_9d	GHSA-2587-w93g-63m2

References

https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2521