Access Token Exposure in Jenkins Dingding JSON Pusher Plugin by Jenkins
CVE-2023-50773

4.3MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Dingding Json Pusher Plugin
Vendor
CVE Published:
13 December 2023

Summary

The Dingding JSON Pusher Plugin versions up to 2.0 for Jenkins fails to mask access tokens in the job configuration form. This oversight allows potential attackers to view and capture sensitive access tokens, which could lead to unauthorized access or actions. It's crucial for users of this plugin to review their configurations and implement necessary security measures to mitigate this risk.

Affected Version(s)

Jenkins Dingding JSON Pusher Plugin 0 <= 2.0

References

https://www.jenkins.io/security/advisory/2023-12-13/#SECU...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/12/13/4

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.