GCVE - cpe:2.3:a:jenkins:hashicorp_vault:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:hashicorp_vault:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Hashicorp Vault (`fb34c96e-95f8-5a03-ac74-0cc52defaaca`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-67642`	vulnerable	2026-06-08 07:41:20.257969	Details available Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to. Published: 2025-12-10T16:50:40.020Z Updated: 2025-12-10T17:23:56.323Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3045	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-36888`	vulnerable	2026-06-08 05:46:07.974296	Details available A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read permission to obtain credentials stored in Vault with attacker-specified path and keys. Published: 2022-07-27T14:22:14.000Z Updated: 2024-08-03T10:14:29.398Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2593 http://www.openwall.com/lists/oss-security/2022/07/27/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-25197`	vulnerable	2026-06-08 05:41:45.523293	Details available Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system. Published: 2022-02-15T16:11:28.000Z Updated: 2024-08-03T04:36:06.402Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2521	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-25186`	vulnerable	2026-06-08 05:41:45.504755	Details available Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key. Published: 2022-02-15T16:11:11.000Z Updated: 2024-08-03T04:36:06.418Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2429	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-23109`	vulnerable	2026-06-08 05:40:56.334805	Details available Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed. Published: 2022-01-12T19:06:09.000Z Updated: 2024-08-03T03:36:19.195Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2213 http://www.openwall.com/lists/oss-security/2022/01/12/6	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.