CVE-2022-23109
MEDIUMJenkins HashiCorp Vault Plugin <= 3.7.0 - Credential Exposure in Pipeline Build Logs
Title source: llmDescription
Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2213
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2022/01/12/6
Scores
CVSS v3
6.5
EPSS
0.0005
EPSS Percentile
14.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-522
Status
published
Products (2)
com.datapipe.jenkins.plugins/hashicorp-vault-plugin
0 - 3.8.0Maven
jenkins/hashicorp_vault
< 3.7.0
Published
Jan 12, 2022
Tracked Since
Feb 18, 2026