Description
Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/10/23/2
https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1628
Related Vulnerabilities
CVE-2022-29823 Vulnerability in npm package feathers-sequelize
CVE-2021-41246 Vulnerability in npm package express-openid-connect
CVE-2020-28191 Vulnerability in maven package org.togglz:togglz-console
CVE-2020-7739 Vulnerability in npm package phantomjs-seo
CVE-2021-22204 Vulnerability in npm package exiftool-vendored