Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1jdzY4LXhtbTQtYzgzcs0ihw
Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials
Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/password credentials stored on the Jenkins controller.
Permalink: https://github.com/advisories/GHSA-cw68-xmm4-c83rJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jdzY4LXhtbTQtYzgzcs0ihw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: about 1 year ago
CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Identifiers: GHSA-cw68-xmm4-c83r, CVE-2022-23117
References:
- https://nvd.nist.gov/vuln/detail/CVE-2022-23117
- https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2522%20(2)
- http://www.openwall.com/lists/oss-security/2022/01/12/6
- https://github.com/jenkinsci/conjur-credentials-plugin/pull/19
- https://github.com/jenkinsci/conjur-credentials-plugin/releases/tag/conjur-credentials-1.0.10
- https://github.com/advisories/GHSA-cw68-xmm4-c83r
Blast Radius: 1.0
Affected Packages
maven:org.conjur.jenkins:conjur-credentials
Affected Version Ranges: < 1.0.10Fixed in: 1.0.10