Description
Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.
Remediation
References
https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2429
Related Vulnerabilities
CVE-2023-40037 Vulnerability in maven package org.apache.nifi:nifi-hikari-dbcp-service
CVE-2023-24458 Vulnerability in maven package org.jenkins-ci.plugins:bearychat
CVE-2023-31103 Vulnerability in maven package org.apache.inlong:manager-dao
CVE-2019-12041 Vulnerability in maven package org.webjars.bowergithub.jonschlinkert:remarkable
CVE-2018-25031 Vulnerability in maven package org.webjars.bower:swagger-ui