Medium severity6.5NVD Advisory· Published Jan 12, 2022· Updated Jun 17, 2026
CVE-2022-23109
CVE-2022-23109
Description
Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.datapipe.jenkins.plugins:hashicorp-vault-pluginMaven | < 3.8.0 | 3.8.0 |
Affected products
3- cpe:2.3:a:jenkins:hashicorp_vault:*:*:*:*:*:jenkins:*:*Range: <=3.7.0
- Range: unspecified
Patches
Vulnerability mechanics
References
5- www.openwall.com/lists/oss-security/2022/01/12/6nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-h6x7-jq46-fp33ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-23109ghsaADVISORY
- www.jenkins.io/security/advisory/2022-01-12/nvdVendor AdvisoryWEB
- github.com/jenkinsci/hashicorp-vault-plugin/commit/c7ad9779320bd8640d83790a985ebab240249b13ghsaWEB
News mentions
1- Jenkins Security Advisory 2022-01-12Jenkins Security Advisories · Jan 12, 2022