CVE-2022-23117

Maven/org.conjur.jenkins:conjur-credentials CVE-2022-23117: medium 5.3

Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials

Action: Upgrade org.conjur.jenkins:conjur-credentials to 1.0.10 or later.

Affected

Fixed versions

Sources

• osv: GHSA-cw68-xmm4-c83r
• https://nvd.nist.gov/vuln/detail/CVE-2022-23117
• https://github.com/jenkinsci/conjur-credentials-plugin/pull/19
• https://github.com/jenkinsci/conjur-credentials-plugin
• https://github.com/jenkinsci/conjur-credentials-plugin/releases/tag/conjur-credentials-1.0.10
• https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2522%20(2)
• http://www.openwall.com/lists/oss-security/2022/01/12/6

CVE-2022-23117 · published 2022-01-13T00:00:53Z · modified 2026-09-10T03:49:10.811577623Z · JSON