CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2022-25186
Medium (6.5) in jenkins hashicorp vault. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in com.datapipe.jenkins.plugins:hashicorp-vault-plugin 336.v182c0fbaaeb7.
Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:hashicorp_vault
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fm6q-97gw-c4wh | Maven | com.datapipe.jenkins.plugins:hashicorp-vault-plugin | <336.v182c0fbaaeb7 | 336.v182c0fbaaeb7 |