Description

Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Remediation

References

https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2056

Related Vulnerabilities

CVE-2017-15681 Vulnerability in maven package org.craftercms:crafter-studio

CVE-2019-1003052 Vulnerability in maven package org.jenkins-ci.plugins:aws-beanstalk-publisher-plugin

CVE-2023-32998 Vulnerability in maven package com.rapid7:jenkinsci-appspider-plugin

CVE-2020-2143 Vulnerability in maven package org.jenkins-ci.plugins:logstash

CVE-2019-12421 Vulnerability in maven package org.apache.nifi:nifi-web-ui

Severity

Medium

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory