Lucene search
GoogleOSV:GHSA-XG8P-CP7F-CPHXHistoryMay 24, 2022 - 4:57 p.m.
DingTalk Plugin stores credentials in plain text
2022-05-2416:57:28
Google
osv.dev
7
Jenkins Dingding notifications Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
References
www.openwall.com/lists/oss-security/2019/10/01/2
github.com/jenkinsci/dingtalk-plugin
github.com/jenkinsci/dingtalk-plugin/commit/b2d4b3ecd2f467ae344eef55d8b51ae765d054a0
jenkins.io/security/advisory/2019-10-01/#SECURITY-1423
nvd.nist.gov/vuln/detail/CVE-2019-10433
www.zerodayinitiative.com/advisories/ZDI-19-862
Related
cve
cve
CVE-2019-10433
2019-10-01 14:15:28
cvelist
cvelist
CVE-2019-10433
2019-10-01 13:45:20
nvd
nvd
CVE-2019-10433
2019-10-01 14:15:28
prion
prion
Design/Logic Flaw
2019-10-01 14:15:00
github
github
DingTalk Plugin stores credentials in plain text
2022-05-24 16:57:28
zdi
zdi
osv
osv
CVE-2019-10433
2019-10-01 14:15:28