CVE-2022-25186

Description

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.074

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2022-25186 are fixed in Jenkins - hashicorp-vault-plugin 336.v182c0fbaaeb7	Windows
Vulnerabilities CVE-2022-25186 are fixed in Jenkins - hashicorp-vault-plugin for Linux 336.v182c0fbaaeb7	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234