GitHub Advisoryadvisory · Maven

GHSA-q5cj-xf99-79m8 Displayed in plain text by Dingding JSON Pusher Plugin

MEDIUM Published 2023-12-13 Modified 2023-12-18 Official page ↗
Aliases
CVE-2023-50773
Ecosystem
Maven
Packages
com.zintow:dingding-json-pusher
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-312
Reviewed
2023-12-13

Affected packages

• Maven com.zintow:dingding-json-pusher: <= 2.0 (no fix yet)

Description

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Related

Alias · CVE (1)

  • CVE-2023-50773 Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-312 Cleartext Storage of Sensitive Information weakness

References