Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin allows reading arbitrary files

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-25197 · ADVISORY
• jenkinsci/hashicorp-vault-plugin commit c564958 · WEB
• jenkinsci/hashicorp-vault-plugin · PACKAGE
• jenkinsci/hashicorp-vault-plugin release 351.vdb_f83a_1c6a_9d · WEB
• jenkins.io/security/advisory/2022-02-15 · WEB

com.datapipe.jenkins.plugins:hashicorp-vault-plugin のその他の脆弱性

• CVE-2025-67642中 4.3Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing a…
• CVE-2023-33001高 7.5Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build…
• CVE-2022-36888中 6.5A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read permission t…
• CVE-2022-25186中 6.5Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use …
• CVE-2022-23109中 6.5Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions whe…