4.3 Medium

CVE-2024-34147 Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file…

Description

Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Telegram Bot Plugin 1.4	earliest → 1.4.0	No fix stated
jenkins-telegram-bot	Versions not published

Do you use Jenkins Telegram Bot Plugin?

Track this CVE Watch Jenkins Telegram Bot Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2024-34147

Timeline

Published May 2, 2024
Last modified February 13, 2025

References

Jenkins Security Advisory 2024-05-02 www.jenkins.io
www.openwall.com www.openwall.com

Track this CVE