CVE-2019-10459 Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token
Attackers with Extended Read permission or file system access can view unencrypted webhook secrets in Jenkins configuration files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10459?
CVE-2019-10459 is a medium-severity vulnerability in Jenkins Mattermost Notification Plugin, published on 23 Oct 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
Weakness: CWE-522
Which versions are affected by CVE-2019-10459?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:mattermost. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:mattermost Maven | All versions | 2.7.1 |
org.jenkins-ci.plugins:mattermost Maven | All versions | 2.7.1 |
Products include Jenkins Mattermost Notification.
How do I fix CVE-2019-10459?
Upgrade org.jenkins-ci.plugins:mattermost to 2.7.1 or later.
Is CVE-2019-10459 being exploited?
There is no known exploitation of CVE-2019-10459 in the wild and no public exploit code.
Sources
Also known as GHSA-xcj6-4355-2823.