CVE-2022-23117
Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials
概要
Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/password credentials stored on the Jenkins controller.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Maven
org.conjur.jenkins:conjur-credentials
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10"}]}]
参照URL
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web jenkins.io
- web openwall.com