Description
Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Remediation
References
http://www.openwall.com/lists/oss-security/2023/12/13/4
https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3184
Related Vulnerabilities
CVE-2020-7663 Vulnerability in maven package org.webjars.npm:websocket-extensions
CVE-2016-7103 Vulnerability in npm package jquery-ui
CVE-2023-6394 Vulnerability in maven package io.quarkus:quarkus-smallrye-graphql
CVE-2020-2189 Vulnerability in maven package org.jenkins-ci.plugins:scm-filter-jervis
CVE-2022-34192 Vulnerability in maven package org.jenkins-ci.plugins:ontrack