Description

Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Remediation

References

https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2088

Related Vulnerabilities

CVE-2018-1000151 Vulnerability in maven package org.jenkins-ci.plugins:vsphere-cloud

CVE-2019-1003068 Vulnerability in maven package com.inkysea.vmware.vra:vmware-vrealize-automation-plugin

CVE-2022-4492 Vulnerability in maven package io.undertow:undertow-core

CVE-2019-10475 Vulnerability in maven package org.jenkins-ci.plugins:build-metrics

CVE-2022-41255 Vulnerability in maven package org.jenkins-ci.plugins:cons3rt

Severity

Medium

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory