GitHub Advisoryadvisory · Maven

GHSA-xg8p-cp7f-cphx DingTalk Plugin stores credentials in plain text

LOW Published 2022-05-24 Modified 2023-12-14 Official page ↗
Aliases
CVE-2019-10433
Ecosystem
Maven
Packages
io.jenkins.plugins:dingding-notifications
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-256, CWE-312
Reviewed
2023-12-14

Affected packages

• Maven io.jenkins.plugins:dingding-notifications: < 2.0.0 → fixed in 2.0.0

Description

Jenkins Dingding notifications Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Related

Alias · CVE (1)

  • CVE-2019-10433 Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users… vulnerability

Weakness · CWE (2)

  • CWE-256 Plaintext Storage of a Password weakness
  • CWE-312 Cleartext Storage of Sensitive Information weakness

References