Description
Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Remediation
References
http://www.openwall.com/lists/oss-security/2023/12/13/4
https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3184
Related Vulnerabilities
CVE-2023-34062 Vulnerability in maven package io.projectreactor.netty:reactor-netty-http
CVE-2023-31579 Vulnerability in maven package top.tangyh.basic:lamp-core
CVE-2021-21692 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2023-34455 Vulnerability in maven package org.xerial.snappy:snappy-java
CVE-2024-4367 Vulnerability in maven package org.webjars.bower:pdfjs-dist