Not rated

CVE-2019-10459 Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in…

Description

Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Mattermost Notification Plugin	Versions not published

The 2 CVEs of Jenkins Mattermost Notification Plugin →

CVE-2019-1003026 A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in… Not rated

Do you use Jenkins Mattermost Notification Plugin?

Track this CVE Watch Jenkins Mattermost Notification Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2019-10459

Timeline

Published October 23, 2019
Last modified August 4, 2024

References

jenkins.io jenkins.io
[oss-security] 20191023 Multiple vulnerabilities in Jenkins plugins www.openwall.com

Track this CVE

CVE-2019-10459 Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in…

Description

Affected products and versions

Other CVEs of Jenkins Mattermost Notification Plugin