What is GHSA-fm6q-97gw-c4wh?

GHSA-fm6q-97gw-c4wh is a security advisory published by GitHub Security Advisories with Low severity. Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin

Which CVE IDs does GHSA-fm6q-97gw-c4wh cover?

GHSA-fm6q-97gw-c4wh covers the following CVE IDs: CVE-2022-25186. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fm6q-97gw-c4wh?

GHSA-fm6q-97gw-c4wh has a CVSS v3 base score of 3.1, published by GitHub Security Advisories.

Which products are affected by GHSA-fm6q-97gw-c4wh?

GHSA-fm6q-97gw-c4wh affects 1 product, including: maven/com.datapipe.jenkins.plugins:hashicorp-vault-plugin:\u003c= 3.8.0.

GHSA-fm6q-97gw-c4whLowCVSS 3.1

Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin

Vendor

GitHub Security Advisories

Published

February 16, 2022

Last Modified

February 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-25186 →

📋 Description

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.

🎯 Affected products1

maven/com.datapipe.jenkins.plugins:hashicorp-vault-plugin:<= 3.8.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2022-25186
https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2429
https://github.com/advisories/GHSA-fm6q-97gw-c4wh