Description

Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Remediation

References

https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2088

Related Vulnerabilities

CVE-2022-43418 Vulnerability in maven package org.jenkins-ci.plugins:katalon

CVE-2020-2248 Vulnerability in maven package org.jenkins-ci.plugins:jsgames

CVE-2019-1003049 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2022-22979 Vulnerability in maven package org.springframework.cloud:spring-cloud-function-context

CVE-2020-1941 Vulnerability in maven package org.apache.activemq:activemq-web-console

Severity

Medium

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory