CVE-2019-10459: Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token
Summary
CVE-2019-10459: Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token. Affects org.jenkins-ci.plugins:mattermost versions < 2.7.1. Fixed in 2.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Mattermost Notification Plugin is a plugin for the Jenkins automation server that allows users to send notifications to Mattermost, a popular team collaboration platform. It enables Jenkins to send build notifications, job status updates, and other relevant information to Mattermost channels. The plugin is an integral part of the Jenkins ecosystem and is commonly used by developers and DevOps teams for seamless integration between Jenkins and Mattermost.
Vulnerability Detail
The Jenkins Mattermost Notification Plugin version 2.7.0 and earlier suffers from a vulnerability that involves the unencrypted storage of secret tokens. The plugin stored webhook URLs, which include a secret token, in an unencrypted format in its global configuration file and job config.xml files on the Jenkins master. This means that users with Extended Read permission or access to the master file system could view these secret tokens. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level. Exploiting this vulnerability could lead to unauthorized access to sensitive information or unauthorized use of the webhook URLs.
How To Fix
Minimum fixed version
2.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the latest secure version of the Jenkins Mattermost Notification Plugin.
Conclusion
The Jenkins Mattermost Notification Plugin version 2.7.0 and earlier suffers from a vulnerability that allows unauthorized users to view secret tokens used in webhook URLs. This can lead to unauthorized access to sensitive information or unauthorized use of the webhook URLs. To mitigate this vulnerability, it is essential to upgrade to version 2.7.1 or later of the plugin, which encrypts the secret tokens. Additionally, users can utilize the Vulert Playground to check if their Jenkins installation is affected by this vulnerability. For further support and guidance, reach out to DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:mattermost →
FAQ
This vulnerability could allow unauthorized users to view the secret tokens used in webhook URLs, potentially leading to unauthorized access to sensitive information or unauthorized use of the webhook URLs.
Users of Jenkins Mattermost Notification Plugin versions 2.7.0 and earlier are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
There are no known exploits for this vulnerability at the time of this report. However, it is crucial to address the vulnerability promptly to mitigate any potential risks.
For further support on vulnerability remediation and securing your Jenkins installation, you can reach out to info@devnack.com. The Devnack team specializes in Jenkins security and can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:mattermost.
