Description
Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.
Remediation
References
https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2429
Related Vulnerabilities
CVE-2020-6427 Vulnerability in npm package electron
CVE-2023-25345 Vulnerability in npm package swig-templates
CVE-2022-45378 Vulnerability in maven package soap:soap
CVE-2020-17530 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2023-29471 Vulnerability in maven package com.typesafe.akka:akka-stream-kafka_2.12