Description
Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Remediation
References
http://www.openwall.com/lists/oss-security/2023/12/13/4
https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3184
Related Vulnerabilities
CVE-2023-46650 Vulnerability in maven package com.coravy.hudson.plugins.github:github
CVE-2020-6429 Vulnerability in maven package org.webjars.npm:electron
CVE-2023-24453 Vulnerability in maven package org.jenkins-ci.plugins:testquality-updater
CVE-2022-28889 Vulnerability in maven package org.apache.druid:druid