Description

Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2020/07/02/7

https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1627

Related Vulnerabilities

CVE-2020-2255 Vulnerability in maven package io.jenkins.blueocean:blueocean-parent

CVE-2018-8037 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2021-21252 Vulnerability in maven package org.webjars.bowergithub.jquery-validation:jquery-validation

CVE-2023-50767 Vulnerability in maven package org.sonatype.nexus.ci:nexus-jenkins-plugin

CVE-2020-7709 Vulnerability in maven package org.webjars.npm:json-pointer

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory CWE-522