GHSA-xcj6-4355-2823

Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10459

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:mattermost	< 2.7.1	2.7.1

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10459 advisory
https://github.com/jenkinsci/mattermost-plugin/commit/c6e509307812d93ba295a35dea95016f007de158 web
https://github.com/jenkinsci/mattermost-plugin package
https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1628 web
http://www.openwall.com/lists/oss-security/2019/10/23/2 web