PT-2022-15860 · Jenkins · Jenkins Conjur Secrets Plugin+1

Published 2022-01-12 · Updated 2023-11-30 · CVE-2022-23117

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Conjur Secrets Plugin versions 1.0.9 and earlier

Description The issue allows attackers who can control agent processes to retrieve all username/password credentials stored on the Jenkins controller. This is due to the implementation of certain functionality in the affected plugin.

Recommendations For Jenkins Conjur Secrets Plugin versions 1.0.9 and earlier, update to a version later than 1.0.9 to resolve the issue.

Fix

Improper Privilege Management

Insufficiently Protected Credentials

Weakness Enumeration

CWE-269

CWE-522

Related Identifiers

CVE-2022-23117

GHSA-CW68-XMM4-C83R

Affected Products

Jenkins

Jenkins Conjur Secrets Plugin

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2022-23117 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23117 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cw68-xmm4-c83r · Vendor Advisory
• https://jenkins.io/security/advisory/2022-01-12/#SECURITY-2522%20%282%29 · Vendor Advisory
• https://github.com/jenkinsci/conjur-credentials-plugin/releases/tag/conjur-credentials-1.0.10 · Note
• https://github.com/jenkinsci/conjur-credentials-plugin · Note
• https://github.com/jenkinsci/conjur-credentials-plugin/pull/19 · Note
• https://t.me/cvenotify/25344 · Telegram Post
• https://t.me/cvenotify/61774 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/12/6 · Note
• https://jenkins.io/security/advisory/2022-01-12/#SECURITY-2522%20(2) · Note