Plaintext storage in Jenkins instant-messaging Plugin

2022-03-3000:00:25

Google

osv.dev

0.001 Low

EPSS

Percentile

28.5%

JSON

Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

CPENameOperatorVersion
org.jvnet.hudson.plugins:instant-messagingeq1.25
org.jvnet.hudson.plugins:instant-messagingeq1.3
org.jvnet.hudson.plugins:instant-messagingeq1.32
org.jvnet.hudson.plugins:instant-messagingeq1.8
org.jvnet.hudson.plugins:instant-messagingeq1.35
org.jvnet.hudson.plugins:instant-messagingeq1.23
org.jvnet.hudson.plugins:instant-messagingeq1.30
org.jvnet.hudson.plugins:instant-messagingeq1.29
org.jvnet.hudson.plugins:instant-messagingeq1.4
org.jvnet.hudson.plugins:instant-messagingeq1.20

Name	Operator	Version
org.jvnet.hudson.plugins:instant-messaging	eq	1.25
org.jvnet.hudson.plugins:instant-messaging	eq	1.3
org.jvnet.hudson.plugins:instant-messaging	eq	1.32
org.jvnet.hudson.plugins:instant-messaging	eq	1.8
org.jvnet.hudson.plugins:instant-messaging	eq	1.35
org.jvnet.hudson.plugins:instant-messaging	eq	1.23
org.jvnet.hudson.plugins:instant-messaging	eq	1.30
org.jvnet.hudson.plugins:instant-messaging	eq	1.29
org.jvnet.hudson.plugins:instant-messaging	eq	1.4
org.jvnet.hudson.plugins:instant-messaging	eq	1.20