CVE-2022-23117
Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials
Summary
Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials
Original description
The description as published by the source.
Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/password credentials stored on the Jenkins controller.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Maven
org.conjur.jenkins:conjur-credentials
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10"}]}]
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web jenkins.io
- web openwall.com