CVE-2022-34800

Name of the Vulnerable Software and Affected Versions Jenkins Build Notifications Plugin versions 1.5.0 and earlier

Description The issue allows users with access to the Jenkins controller file system to view tokens stored unencrypted in the plugin's global configuration files. Specifically, multiple tokens are stored unencrypted, including the Pushover Application Token in tools.devnull.jenkins.plugins.buildnotifications.PushoverNotifier.xml, the Slack Bot Token in tools.devnull.jenkins.plugins.buildnotifications.SlackNotifier.xml, and the Telegram Bot Token in tools.devnull.jenkins.plugins.buildnotifications.TelegramNotifier.xml.

Recommendations For Jenkins Build Notifications Plugin versions 1.5.0 and earlier, consider restricting access to the Jenkins controller file system to minimize the risk of token exposure. As a temporary workaround, restrict access to the configuration files tools.devnull.jenkins.plugins.buildnotifications.PushoverNotifier.xml, tools.devnull.jenkins.plugins.buildnotifications.SlackNotifier.xml, and tools.devnull.jenkins.plugins.buildnotifications.TelegramNotifier.xml to prevent unauthorized viewing of the tokens. At the moment, there is no information about a newer version that contains a fix for this vulnerability.