Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.
Weakness
The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Hashicorp_vault | Jenkins | * | 371.v884a_4dd60fb_6 (including) |