CVE-2022-25186

CVE-2022-25186: vulnerability in Jenkins HashiCorp Vault Plugin

Published · Updated

Follow this CVE+ Monitor Jenkins HashiCorp Vault Plugin+ Monitor com.datapipe.jenkins.plugins:hashicorp-vault-plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.8%
Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.
Affected products
Jenkins project · Jenkins HashiCorp Vault Plugin
Related CVEs — Jenkins HashiCorp Vault Plugin

In the same product, most dangerous first.

CVE-2022-23109—CVE-2022-23109EPSS 1.0%CVE-2022-25197—CVE-2022-25197EPSS 0.8%CVE-2022-36888—CVE-2022-36888EPSS 0.7%