Tokens stored in plain text by Dingding JSON Pusher Plugin
Date: 2023-12
Affected: maven/com.zintow:dingding-json-pusher
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-50766
CVE-2023-50767
CVE-2023-50772
CVE-2023-50776
CWE: CWE-312
CWE-352
CWE-862
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.


Mitigations:

Architectural layers (MAESTRO):