VulnerabilityModified

CVE-2023-50773

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

MEDIUM 4.3EPSS 0.35%

Does this matter?

Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own.

Description

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.35% probability · 28th percentile
CISA KEV: Not listed
Weakness: CWE-312
Affected: jenkins/dingding json pusher
Source: jenkinsci-cert@googlegroups.com

References

http://www.openwall.com/lists/oss-security/2023/12/13/4Mailing List
https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3184Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/12/13/4Mailing List
https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3184Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.