| Package | Affected versions | Patched versions |
|---|---|---|
| tools.devnull:build-notifications | ≤ 1.5.0 | |
| build notifications | ≤ 1.5.0 |
Build Notifications Plugin 1.5.0 and earlier stores multiple tokens unencrypted in its global configuration files on the Jenkins controller as part of its configuration:- Pushover Application Token in tools.devnull.jenkins.plugins.buildnotifications.PushoverNotifier.xml\n- Slack Bot Token in tools.devnull.jenkins.plugins.buildnotifications.SlackNotifier.xml\n- Telegram Bot Token in tools.devnull.jenkins.plugins.buildnotifications.TelegramNotifier.xml
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free