Multiple vulnerabilities in Jenkins Dingding JSON Pusher plugin

Published: 2023-12-15

Risk	Medium
Patch available	NO
Number of vulnerabilities	2
CVE-ID	CVE-2023-50772 CVE-2023-50773
CWE-ID	CWE-312 CWE-200
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Dingding JSON Pusher Web applications / Modules and components for CMS
Vendor	Jenkins

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Cleartext storage of sensitive information

EUVDB-ID: #VU84458

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-50772

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected plugin stores access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration. A remote user can gain access to sensitive information.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Dingding JSON Pusher: 1.0 - 2.0

CPE2.3

External links

https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3184
https://www.openwall.com/lists/oss-security/2023/12/13/4

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU84459