Lucene search

GoogleOSV:GHSA-94PR-W968-H923

HistoryMay 02, 2024 - 3:30 p.m.

Jenkins Telegram Bot Plugin stores the Telegram Bot token in plaintext

2024-05-0215:30:35

Google

osv.dev

jenkins

telegram bot plugin

plaintext storage

global configuration file

telegram bot token

unencrypted

security advisory

jenkins controller file system

no fix.

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.7%

JSON

Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file jenkinsci.plugins.telegrambot.TelegramBotGlobalConfiguration.xml on the Jenkins controller as part of its configuration.

This token can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

References

www.openwall.com/lists/oss-security/2024/05/02/3

github.com/jenkinsci/telegram-notifications-plugin

nvd.nist.gov/vuln/detail/CVE-2024-34147

www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3294