GHSA-xg8p-cp7f-cphx

DingTalk Plugin stores credentials in plain text

Source: GitHub Advisory Database (reviewed) Low CVE-2019-10433

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.jenkins.plugins:dingding-notifications	< 2.0.0	2.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Dingding notifications Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10433 advisory
https://github.com/jenkinsci/dingtalk-plugin/commit/b2d4b3ecd2f467ae344eef55d8b51ae765d054a0 web
https://github.com/jenkinsci/dingtalk-plugin package
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1423 web
https://www.zerodayinitiative.com/advisories/ZDI-19-862 web
http://www.openwall.com/lists/oss-security/2019/10/01/2 web