Description
Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Remediation
References
https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2056
Related Vulnerabilities
CVE-2022-41935 Vulnerability in maven package org.xwiki.platform:xwiki-platform-livetable-ui
CVE-2023-44402 Vulnerability in npm package electron
CVE-2021-21616 Vulnerability in maven package org.biouno:uno-choice
CVE-2014-0050 Vulnerability in maven package org.apache.tomcat:tomcat-coyote
CVE-2020-11991 Vulnerability in maven package org.apache.cocoon:cocoon-core