CVE-2023-50772

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed…

published December 13, 2023

CVSS
—
EPSS
0%
Percentile
27.0
In the wild
Unconfirmed
What it is

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00347 · 27.0th percentile
Published
2023-12-13T17:30Z
EPSS history
Timeline
  • 13 DEC 17:30Z
    Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed…
    cvelistv5