PT-2022-15851 · Hashicorp+1 · Jenkins Hashicorp Vault Plugin+1

Jasen Minton · Published 2022-01-12 · Updated 2023-11-15 · CVE-2022-23109

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins HashiCorp Vault Plugin versions 3.7.0 and earlier

Description The issue concerns the Jenkins HashiCorp Vault Plugin, where Vault credentials are not masked in Pipeline build logs or in Pipeline step descriptions when the Pipeline: Groovy Plugin 2.85 or later is installed. This could potentially expose sensitive information.

Recommendations For Jenkins HashiCorp Vault Plugin versions 3.7.0 and earlier, update to a version later than 3.7.0 to ensure Vault credentials are properly masked in Pipeline build logs and step descriptions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-23109

GHSA-H6X7-JQ46-FP33

Affected Products

Jenkins

Jenkins Hashicorp Vault Plugin

References · 10

• https://osv.dev/vulnerability/GHSA-h6x7-jq46-fp33 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23109 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-01-12/#SECURITY-2213 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23109 · Security Note
• https://github.com/jenkinsci/hashicorp-vault-plugin/commit/c7ad9779320bd8640d83790a985ebab240249b13 · Note
• https://github.com/jenkinsci/hashicorp-vault-plugin · Note
• https://t.me/cvenotify/25611 · Telegram Post
• https://t.me/cibsecurity/35358 · Telegram Post
• https://t.me/cvenotify/25352 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/12/6 · Note