CVE-2019-10459 — Insufficiently Protected Credentials in Jenkins Mattermost Notification

CWE-522 — Insufficiently Protected Credentials4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 85.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
12
Jenkins Mattermost NotificationJenkins Project Jenkins Mattermost Notification PluginJenkins Bitbucket Oauth Plugin+9 more
Timeline
PublishedOct 23
Latest updateMay 24

Description

Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages12 packages

🔴Vulnerability Details

2
GHSA
Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token↗2022-05-24
▶
OSV
Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token↗2022-05-24
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2019-10-23↗2019-10-23
▶