CVE-2022-23109 Improper credentials masking in Jenkins HashiCorp Vault Plugin
Attackers can read Vault credentials from Jenkins build logs due to missing masking in the HashiCorp Vault plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23109?
CVE-2022-23109 is a medium-severity vulnerability in Jenkins HashiCorp Vault Plugin, published on 12 Jan 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed.
Weakness: CWE-522
Which versions are affected by CVE-2022-23109?
2 open source packages ship an affected version, including com.datapipe.jenkins.plugins:hashicorp-vault-plugin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.datapipe.jenkins.plugins:hashicorp-vault-plugin Maven | All versions | 3.8.0 |
com.datapipe.jenkins.plugins:hashicorp-vault-plugin Maven | All versions | 3.8.0 |
Products include Jenkins Hashicorp Vault.
How do I fix CVE-2022-23109?
Upgrade com.datapipe.jenkins.plugins:hashicorp-vault-plugin to 3.8.0 or later.
Is CVE-2022-23109 being exploited?
There is no known exploitation of CVE-2022-23109 in the wild and no public exploit code.
Other vulnerabilities in Jenkins HashiCorp Vault Plugin
- CVE-2023-33001 Jenkins HashiCorp Vault Plugin has improper masking of credentials
- CVE-2022-36888 Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests
- CVE-2022-25186 Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin
- CVE-2022-25197 Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin allows reading arbitrary files
- CVE-2025-67642 Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials
Sources
Also known as GHSA-h6x7-jq46-fp33.