← Back

CVE-2022-25186

nvd nist
Published: Feb 15, 2022Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.

Affected (1)

Jenkins
1 product
Hashicorp Vault
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Hashicorp Vault
Up to 3.8.0

References (2)

Source: jenkinsci-cert@googlegroups.com
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory

Timeline

No history available yet.