CVE-2023-50772

CVE-2023-50772 affects the Jenkins Dingding JSON Pusher Plugin 2.0 and earlier. The issue is that access tokens are stored unencrypted in job config.xml files on the Jenkins controller, enabling viewing by users with Item/Extended Read permission or access to the controller file system. The conne...

CVE-2023-50773

CVE-2023-50773 affects Jenkins Dingding JSON Pusher Plugin 2.0 and earlier. The vulnerability arises because the plugin stores access tokens unencrypted in job config.xml (CVE-2023-50772) and does not mask access tokens displayed on the job configuration form (CVE-2023-50773). This can allow atta...