What is GHSA-vpf7-q2rx-26mh?

GHSA-vpf7-q2rx-26mh is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests

Which CVE IDs does GHSA-vpf7-q2rx-26mh cover?

GHSA-vpf7-q2rx-26mh covers the following CVE IDs: CVE-2022-36888. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vpf7-q2rx-26mh?

GHSA-vpf7-q2rx-26mh has a CVSS v3 base score of 4.2, published by GitHub Security Advisories.

Which products are affected by GHSA-vpf7-q2rx-26mh?

GHSA-vpf7-q2rx-26mh affects 1 product, including: maven/com.datapipe.jenkins.plugins:hashicorp-vault-plugin:\u003c= 354.vdb.

GHSA-vpf7-q2rx-26mhMediumCVSS 4.2

Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests

Vendor

GitHub Security Advisories

Published

July 28, 2022

Last Modified

January 5, 2024

🔗 CVE IDs covered (1)

CVE-2022-36888 →

📋 Description

A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read permission to obtain credentials stored in Vault with attacker-specified path and keys.

🎯 Affected products1

maven/com.datapipe.jenkins.plugins:hashicorp-vault-plugin:<= 354.vdb

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-36888
https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2593
http://www.openwall.com/lists/oss-security/2022/07/27/1
https://github.com/jenkinsci/hashicorp-vault-plugin/commit/3b38d767aba8bd98d6f4fb53c1f1678d95b5e752
https://github.com/advisories/GHSA-vpf7-q2rx-26mh