GitHub Advisoryadvisory · Maven

GHSA-xcj6-4355-2823 Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token

MEDIUM Published 2022-05-24 Modified 2025-08-12 Official page ↗
Aliases
CVE-2019-10459
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:mattermost
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-522
Reviewed
2022-12-06

Affected packages

• Maven org.jenkins-ci.plugins:mattermost: < 2.7.1 → fixed in 2.7.1

Description

Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

Related

Alias · CVE (1)

  • CVE-2019-10459 Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References