CVE-2019-10459

· MEDIUMModified

← All CVEs

CVSS v3.1

6.5

EPSS

0.93%

Published

Oct 23, 2019

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-522

Affected Products (1)

jenkins · mattermost_notificationvulnerable

References (4)

http://www.openwall.com/lists/oss-security/2019/10/23/2

Mailing ListThird Party Advisory

https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1628

Vendor Advisory

http://www.openwall.com/lists/oss-security/2019/10/23/2

Mailing ListThird Party Advisory

https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1628

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs