Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin

2022-02-1600:01:28

Google

osv.dev

0.001 Low

EPSS

Percentile

28.4%

JSON

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.

CPENameOperatorVersion
com.datapipe.jenkins.plugins:hashicorp-vault-plugineq2.3.1
com.datapipe.jenkins.plugins:hashicorp-vault-plugineq1.2
com.datapipe.jenkins.plugins:hashicorp-vault-plugineq3.1.0
com.datapipe.jenkins.plugins:hashicorp-vault-plugineq3.0.0
com.datapipe.jenkins.plugins:hashicorp-vault-plugineq2.3.0
com.datapipe.jenkins.plugins:hashicorp-vault-plugineq3.4.1
com.datapipe.jenkins.plugins:hashicorp-vault-plugineq3.8.0
com.datapipe.jenkins.plugins:hashicorp-vault-plugineq3.1.1
com.datapipe.jenkins.plugins:hashicorp-vault-plugineq3.6.1
com.datapipe.jenkins.plugins:hashicorp-vault-plugineq3.7.0

Name	Operator	Version
com.datapipe.jenkins.plugins:hashicorp-vault-plugin	eq	2.3.1
com.datapipe.jenkins.plugins:hashicorp-vault-plugin	eq	1.2
com.datapipe.jenkins.plugins:hashicorp-vault-plugin	eq	3.1.0
com.datapipe.jenkins.plugins:hashicorp-vault-plugin	eq	3.0.0
com.datapipe.jenkins.plugins:hashicorp-vault-plugin	eq	2.3.0
com.datapipe.jenkins.plugins:hashicorp-vault-plugin	eq	3.4.1
com.datapipe.jenkins.plugins:hashicorp-vault-plugin	eq	3.8.0
com.datapipe.jenkins.plugins:hashicorp-vault-plugin	eq	3.1.1
com.datapipe.jenkins.plugins:hashicorp-vault-plugin	eq	3.6.1
com.datapipe.jenkins.plugins:hashicorp-vault-plugin	eq	3.7.0