Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2022-23117 · ADVISORY
• jenkinsci/conjur-credentials-plugin#19 · WEB
• jenkinsci/conjur-credentials-plugin · PACKAGE
• jenkinsci/conjur-credentials-plugin release conjur-credentials-1.0.10 · WEB
• jenkins.io/security/advisory/2022-01-12 · WEB
• openwall.com/lists/oss-security/2022/01/12/6 · WEB
• jenkins.io/security/advisory/2022-01-12 · Vendor Advisory

Lỗ hổng khác của org.conjur.jenkins:conjur-credentials

• CVE-2022-25190TRUNG BÌNH 4.3A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate cr…
• CVE-2022-23116CAO 7.5Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt se…